How to fix Event ID 86: CertificateServicesClient-CertEnroll in Windows?

Event ID 86 from CertificateServicesClient-CertEnroll means Windows tried to get a certificate for your TPM chip from a Microsoft service, and the request failed with Not Found (404). On a home PC it is safe to ignore and it does not cause blue screens. Read the URL in the event first, then look for the real crash event if your PC crashes.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Event ID 86 CertificateServicesClient-CertEnroll means

CertEnroll is the part of Windows that requests certificates. One of its jobs on a PC with a TPM (Trusted Platform Module, the security chip or its firmware version in the processor) is to get an attestation certificate for a key inside the TPM. Attestation lets a service check that a key really lives in a real TPM.

Windows sends that request with SCEP, a certificate enrollment protocol, to an address built from the TPM maker and the key ID. When the Microsoft service has no authority for that address, the first step of the request (GetCACaps) gets 404 Not Found, and Windows writes Event 86. This is what a full event looks like, as posted by users on Microsoft Q&A:

Event 86, source CertificateServicesClient-CertEnroll (user report, key ID shortened)

SCEP Certificate enrollment initialization for Local system via
https://AMD-KeyId-907d65e9b5....microsoftaik.azure.net/templates/Aik/scep failed

GetCACaps
GetCACaps: Not Found
{"Message":"The authority "amd-keyid-907d65e9b5....microsoftaik.azure.net" does not exist."}
HTTP/1.1 404 Not Found

Method: GET(453ms)
Stage: GetCACaps
Not found (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

• AMD-KeyId-... names a key in an AMD firmware TPM (fTPM). On VMware virtual machines with a virtual TPM the prefix is vmw-keyid-.... We could not confirm the prefixes of other TPM makers.
• microsoftaik.azure.net/templates/Aik/scep is Microsoft's AIK service. Your PC asked it, the PC was not asked by anyone else.
• 0x80190194 is the Windows form of HTTP 404 Not Found. The decimal form -2145844844 is the same code.
• Level Error is how the source rates its own failure. It does not mean that Windows or your files are damaged.

Why CertEnroll Event 86 appears, most common cause first

When you can ignore Event 86 and when to act

Users on Microsoft Q&A have tied Event 86 to game crashes and even replaced hardware. In those reports the 86 rows were the visible ones, but nobody showed that they caused the crash. Compare the time of the crash with the time of each 86 row before you change anything.

How to fix Event ID 86: CertificateServicesClient-CertEnroll

Fix 1 takes five minutes and tells you which kind of Event 86 you have. On most home PCs it is also the last step. Fix 2 keeps the TPM firmware and Windows current. Fix 3 is for real crashes, Fix 4 for work PCs, and Fix 5 and Fix 6 for a system that has other faults.

Fix 1. Read the URL in Event 86 and check that nothing is broken

5 minutesNo riskEveryone who found these rows, before changing anything.

Event 86 has one part that changes: the address Windows tried. A microsoftaik.azure.net address means TPM attestation, which a home PC does not need, so the row explains itself.

1. Press Win + X and select Event Viewer.
2. Select Action > Create Custom View, choose By source, tick CertificateServicesClient-CertEnroll, type 86 in the event ID box and select OK. Give the view a name.
3. Open the newest row and read the General tab. Note the URL after via.
4. If the URL ends in microsoftaik.azure.net/templates/Aik/scep, this is the TPM attestation request. If it is a company address, go to Fix 4.
5. Check the time of the rows against the time of any crash you saw. If they do not match and the PC works, you are done.

The same list in PowerShell: right-click Start, select Terminal (Admin) and run the command below. It reads the log and changes nothing.

PowerShell: the last 20 Event 86 rows from CertEnroll with time and URL

Get-WinEvent -FilterHashtable @{ ProviderName='Microsoft-Windows-CertificateServicesClient-CertEnroll'; Id=86 } -MaxEvents 20 |
  Format-List TimeCreated, Message

We had no PC with these rows to run the command against. If it returns nothing while Event Viewer shows rows, use the custom view from the steps.

Fix 2. Check the TPM and update Windows, the BIOS and the chipset driver

15 to 30 minutesRead the warningThe rows name your TPM and the BIOS or Windows has not been updated for months, or you want to be sure the TPM itself is fine.

On AMD PCs the firmware TPM is part of the BIOS, so a BIOS update is the only way to update it. A Microsoft Community support specialist answering an AMD Event 86 report recommended installing the latest updates first. It may not stop the rows, but it rules out an old TPM firmware.

1. Press Win + R, type tpm.msc and press Enter. Under Status, check that it says The TPM is ready for use, and note the Manufacturer Name and Specification Version.
2. Open Settings > Windows Update (Windows 10: Settings > Update & Security > Windows Update), select Check for updates, install everything and restart.
3. Press Win + R, type msinfo32 and press Enter. Note System Model and BIOS Version/Date.
4. On your PC or motherboard maker's support page, look up that model. Install a newer BIOS with the maker's tool, and the latest chipset driver (for AMD boards, the AMD chipset driver).
5. Restart, then run the Fix 1 command again after a day of normal use.

Fix 3. Find the event that really explains the blue screen or restart

10 to 20 minutesNo riskThe PC shows blue screens, freezes or restarts on its own, and you found Event 86 near the crash.

A blue screen writes its own stop code, and a sudden restart writes its own events. Event 86 is a network request that failed, so reading the crash events is the fastest way to the real cause, such as the DPC_WATCHDOG_VIOLATION the reader above may have seen.

1. In Event Viewer, open Windows Logs > System and select Filter Current Log.
2. Type 41,1001,6008 in the event ID box and select OK.
3. Open the row at the time of the crash. BugCheck 1001 holds the stop code, Kernel-Power 41 says the PC restarted without a clean shutdown, EventLog 6008 says the shutdown was unexpected.
4. Press Win + R, type perfmon /rel and press Enter. Reliability Monitor shows crashes, updates and driver installs day by day.
5. Search the stop code from BugCheck 1001 and fix that. Ignore the 86 rows while you do.

PowerShell: crash events of the last 14 days

Get-WinEvent -FilterHashtable @{ LogName='System'; Id=41,1001,6008; StartTime=(Get-Date).AddDays(-14) } |
  Format-Table TimeCreated, Id, ProviderName -AutoSize

For the unexpected shutdown events, our guide to Event ID 6008 shows how to read them. If you changed the processor and the PC now warns about the fTPM at startup, see fTPM NV corrupted or structure changed.

Fix 4. On a work or school PC, send the event to your IT team

5 minutesNo riskThe URL in Event 86 is your organization's server, or the PC is managed by Intune or a company domain.

Here Event 86 belongs to the organization's certificate setup, which hands out certificates for Wi-Fi, VPN or email. Only its administrators can change the SCEP server or the profile that points to it.

1. Open the Event 86 row from Fix 1 and select the Details tab, then XML View.
2. Copy the whole XML, including the URL and the error code.
3. Note what fails for you: Wi-Fi, VPN, email or nothing.
4. Press Win + R, type winver, press Enter and note the version and build.
5. Send all of it to IT. Do not change certificate or TPM settings on a managed PC yourself.

Fix 5. Repair Windows system files with DISM and SFC

15 to 30 minutesNo riskCrashes go on after Fix 3, or several apps also fail, and SFC was never run.

This does not stop the 86 rows, which come from an answer on Microsoft's side. It repairs damaged system files that can cause the crashes found in Fix 3.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 6. Remove the last update or go back to a restore point

15 to 30 minutesLow riskBlue screens started on the day a Windows or driver update was installed.

The question above, like many reports, mixes Event 86 with a new crash. If the crash began with an update, removing that update tests the crash directly; the 86 rows will likely stay.

1. Press Win + R, type perfmon /rel and press Enter. Find the day the blue screens began and the update installed that day.
2. Open Settings > Windows Update > Update history (Windows 10: Settings > Update & Security > Windows Update > View update history) and note the KB number installed that day.
3. Uninstall that update: How to uninstall a Windows update
4. Restart and use the PC as before for a day.
5. If the update cannot be removed or the crashes stay, go back to a restore point from before they began: Undo recent changes with System Restore

If nothing helps and the crashes stay, reinstall Windows while keeping your files and apps: Reinstall Windows without losing files

If the PC still crashes: what to read and what to collect

If the PC still crashes after these fixes, Event 86 is very unlikely to be the reason. Collect these before you contact Microsoft, the PC maker or a repair shop:

• The stop code from BugCheck 1001 or from the blue screen itself.
• The minidump files in C:\Windows\Minidump, if there are any.
• Reliability Monitor (perfmon /rel): a screenshot of the days with crashes.
• The TPM status from tpm.msc and the BIOS version from msinfo32.
• One Event 86 row in XML View, only to show that you checked it.

How to keep CertEnroll Event 86 from leading you the wrong way

Frequently asked questions

What is Event ID 86 CertificateServicesClient-CertEnroll?

It is a log entry from the part of Windows that requests certificates. On home PCs it records that Windows asked Microsoft's AIK service at microsoftaik.azure.net for an attestation certificate for the TPM, and the service answered Not Found (404) with code 0x80190194. The URL starts with the TPM maker's key ID, such as AMD-KeyId. No certificate was enrolled, and nothing on the PC depends on it unless an organization manages the device.

Is Event 86 harmful, and can I ignore it?

On a home PC you can ignore it when the URL ends in microsoftaik.azure.net and the PC works. A volunteer answering on Microsoft Q&A says the events only mean that the PC is not in a corporate network managed by Azure. Broadcom describes the same row on VMware virtual machines as an AIK enrollment against a Microsoft endpoint that does not exist. Act only when the URL is your company's or the PC really crashes.

Can Event 86 cause a blue screen or crash on Windows 11?

Nothing we read shows that. A failed certificate request ends with a log entry. Users on Microsoft Q&A report Event 86 next to game crashes and blue screens, but those reports show the rows, not a cause. Find BugCheck 1001 and Kernel-Power 41 at the time of the crash (Fix 3). The stop code in BugCheck 1001, such as DPC_WATCHDOG_VIOLATION, tells you what to fix.

What does SCEP certificate enrollment initialization failed mean?

SCEP is a protocol for requesting certificates, and initialization is its first step, where Windows asks the server what it supports (GetCACaps). Failed means the server did not answer that step. For a microsoftaik.azure.net URL the answer was 404, because the service has no authority for that TPM key. For a company URL, the organization's SCEP server did not answer, which is a question for IT (Fix 4).

Why does the URL say AMD-KeyId?

It is the name Windows builds for a key in an AMD firmware TPM, which is part of the processor and the BIOS. Most home reports of Event 86 come from AMD systems for that reason. It does not mean the AMD processor is faulty. Keep the BIOS and the AMD chipset driver current (Fix 2). On VMware virtual machines the prefix is vmw-keyid, and we could not confirm the prefixes used by other TPM makers.

Should I clear or turn off the TPM to stop Event 86?

No. Clearing the TPM removes its keys, which BitLocker, Windows Hello PINs and some sign-ins use. On a PC with BitLocker you would need the recovery key at the next start. Windows 11 also expects a TPM 2.0. A support reply on Microsoft Q&A pointed to TPM troubleshooting, and users there said the options looked risky. The rows are harmless, so the trade is not worth it.

What is Event ID 87 from CertificateServicesClient-CertEnroll?

It is a different event number from the same source, and we did not research its text for this page. Open it and read the General tab. If it names the same microsoftaik.azure.net URL, the reasoning on this page applies: a failed request from Windows with no effect on a home PC. If it names a company server or a certificate template, give it to IT. Do not apply fixes for 86 to it blindly.

Is Event ID 86 the same on Windows 10?

Yes. The source, text and cause are the same, and so are the fixes; only the Settings paths differ, and the steps give both. Windows 10 left support on 14 October 2025, so it gets no more security fixes. On such a PC, a crash you are chasing is a better reason to move to Windows 11 than Event 86 itself, if the hardware allows it.

I searched id=86 or event 86 in another language. Is it the same?

Event ID 86 means different things from different sources, so check the Source column first. This page is about the source CertificateServicesClient-CertEnroll. In a Russian or Korean Windows, the text is translated but the source, ID and URL stay the same, and the fixes here apply. If the source is something else, such as a disk or network driver, its event 86 has its own meaning.