How to fix SCEP Certificate enrollment initialization failed error in Windows?

"SCEP Certificate enrollment initialization failed" is Event 86 in Event Viewer: Windows asked Microsoft's TPM attestation service for a certificate, and the address built from your TPM's key ID does not exist. On a home PC it is a failed web request in a log, not a crash. Read the event first, then update the BIOS and chipset driver or stop the task that sends the request.

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What SCEP Certificate enrollment initialization failed means

SCEP (Simple Certificate Enrollment Protocol) is a standard way to ask a server for a certificate. Windows uses it here for one narrow job: to get an attestation certificate for the TPM chip, so the TPM can prove to Microsoft services that it is real. The request goes to an address under microsoftaik.azure.net that is built from the TPM maker and the TPM's key ID.

When that address has no entry for your TPM, the service answers Not Found and Windows writes Event 86. This is how the event looks, with the parts that change between PCs shown in angle brackets:

Event 86, source CertificateServicesClient-CertEnroll (text as reported by users and Broadcom)

SCEP Certificate enrollment initialization for Local system via
https://AMD-KeyId-<id>.microsoftaik.azure.net/templates/Aik/scep failed:

GetCACaps
Not Found {"Message":"The authority \"amd-keyid-<id>.microsoftaik.azure.net/templates\" does not exist."}

• AMD-KeyId in the address means the AMD firmware TPM, INTC-KeyId an Intel firmware TPM (PTT), VMW-KeyId the virtual TPM of a VMware virtual machine. Some addresses end in -v2; the meaning is the same.
• for Local system or for WORKGROUP\<PC name>$ only names the account the request ran for. A PC that is in no domain shows WORKGROUP; it does not mean a work network is involved.
• GetCACaps Not Found is the first step of SCEP: Windows asked the server what it supports, and the server said it has no such authority.
• The key ID in the address is unique to your TPM. That is why the searches for this error show dozens of different addresses for the same problem.

Why the SCEP certificate enrollment fails, most common cause first

The direct cause is always the same: the endpoint for your TPM's key ID does not exist. What differs is why Windows keeps trying, and that decides the fix.

When you can ignore Event 86 and when it points to something else

The old version of this page linked the event to AMD graphics drivers and games. We found no source for that. The rows appear on PCs with Intel and NVIDIA hardware too, and on virtual machines with no graphics card at all.

How to fix SCEP Certificate enrollment initialization failed

Fix 1 takes five minutes and tells you which TPM sends the request and whether anything else is wrong. Fix 2 updates the firmware that the address depends on. Fix 3 stops the request, which ends the rows. Fix 4 is for PCs with a leftover work account. Fix 5 and Fix 6 are for the rare case of damaged Windows files.

Fix 1. Read Event 86 and find out which TPM sends the request

5 minutesNo riskEveryone who found these rows, before changing anything.

The address in the event names the TPM type, and the count of rows shows whether the request runs once at startup or many times a day. Both decide which fix to try, and the command changes nothing.

1. Right-click Start and select Terminal (Admin). On Windows 10, search for PowerShell, right-click Windows PowerShell and select Run as administrator.
2. Run the command below. It lists the Event 86 rows of the last 14 days from the CertEnroll source, in both the Application and System logs.
3. Read the address in the message: AMD-KeyId, INTC-KeyId or VMW-KeyId.
4. Note the times. Rows that come at each startup point to the scheduled task in Fix 3.
5. If your PC restarts or freezes, compare these times with the time of the restart. A row minutes earlier is not the cause.

PowerShell: Event 86 rows of the last 14 days (read only)

Get-WinEvent -FilterHashtable @{ LogName='Application','System'; ProviderName='Microsoft-Windows-CertificateServicesClient-CertEnroll'; Id=86; StartTime=(Get-Date).AddDays(-14) } -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, LogName, @{n='Message';e={($_.Message -split "`n")[0]}} |
  Format-Table -AutoSize -Wrap

If the command returns nothing, open Event Viewer (press Win + R, type eventvwr.msc), select Windows Logs > Application, choose Filter Current Log and type 86 in the event ID box. We had no PC with this error to test the command, so check one row against Event Viewer once.

Fix 2. Update the BIOS or UEFI firmware and the chipset driver

20 to 30 minutesLow riskThe address starts with AMD-KeyId or INTC-KeyId, and the PC has a firmware TPM.

The address is built from the firmware TPM's key. Microsoft Q&A moderators tie the invalid address to an AMD BIOS or chipset update, so the board maker's newest firmware and the chipset driver are the first real repair to try.

1. Press Win + R, type msinfo32 and press Enter. Note BaseBoard Manufacturer, BaseBoard Product and BIOS Version/Date.
2. On the board or laptop maker's support page for that model, download the newest BIOS and the chipset driver.
3. Install the chipset driver and restart.
4. Update the BIOS with the maker's own tool or instructions, then restart.
5. Open Settings > Windows Update > Advanced options > Optional updates (Windows 10: Settings > Update & Security > Windows Update > View optional updates) and install the driver updates offered.
6. Run the Fix 1 command again after one or two days of normal use.

For the driver part, the step by step guide is here: Update, roll back or reinstall a driver

Fix 3. Disable the AikCertEnrollTask task that sends the request

5 minutesLow riskThe rows keep coming on a home PC or a virtual machine, and nothing else is wrong.

The enrollment is started by the scheduled task AikCertEnrollTask. A Microsoft Q&A moderator suggested disabling it, and it can be turned back on with one command, so it ends the failed requests without changing anything else.

1. Open Terminal (Admin) as in Fix 1.
2. Run the first command below. It shows where the task is and whether it is Ready or Disabled.
3. If the task is listed, run the second command to disable it.
4. Restart the PC and run the Fix 1 command after a day.
5. To undo it later, run the third command.

PowerShell: find, disable and re-enable AikCertEnrollTask

Get-ScheduledTask -TaskName 'AikCertEnrollTask' | Format-List TaskPath, State

Get-ScheduledTask -TaskName 'AikCertEnrollTask' | Disable-ScheduledTask

Get-ScheduledTask -TaskName 'AikCertEnrollTask' | Enable-ScheduledTask

Fix 4. Remove a leftover work or school account

5 minutesRead the warningA home PC shows an entry under Access work or school, or the PC was once managed by an employer or school.

A device management enrollment can keep asking for certificates long after the PC left the organisation. A Microsoft Q&A moderator suggested disconnecting such an entry for this error, which removes the policy that starts the enrollment.

1. Open Settings > Accounts > Access work or school.
2. Check the list. An account you use for Microsoft 365 at home only is fine and can stay.
3. Select an entry from a former employer or school and choose Disconnect.
4. Confirm and restart the PC.
5. Run the Fix 1 command after a day.

Fix 5. Repair Windows system files with DISM and SFC

15 to 30 minutesNo riskOther system errors appear next to Event 86, or the task commands in Fix 3 fail.

Microsoft Q&A moderators list this scan for the error. It will not create the missing endpoint, but it repairs damaged certificate and task files when they are part of the problem.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 6. Reinstall Windows while keeping files and apps

1 hourLow riskFix 1 to Fix 5 did not help and other parts of Windows misbehave too.

A repair install replaces every Windows file and rebuilds the scheduled tasks while keeping your files and apps. Microsoft moderators suggest it as the last step for this error.

1. Back up important files first: Back up your files (Windows Backup, File History, Time Machine)
2. Open Settings > System > Recovery and select Reinstall now next to Fix problems using Windows Update on Windows 11.
3. On Windows 10, or if that option is missing, run an in-place upgrade from the installation media as shown below.

1. Open Recovery in Settings. Open Settings > System > Recovery. Next to Fix problems using Windows Update, select Reinstall now. This keeps your apps, files and settings.
2. Start the reinstall. Choose whether the PC may restart on its own 15 minutes after the installation, then select OK.
3. Wait and restart. Windows Update downloads and installs a repair copy of your current Windows version. Keep the PC plugged in and online, and restart it when asked.
4. If that did not help: Reset PC. Back in Settings > System > Recovery, next to Reset this PC, select Reset PC. This keeps your personal files but removes installed apps and settings.
5. Choose Keep my files. Select Keep my files. Do not select Remove everything.
6. Choose where Windows comes from. Select Cloud download to download a fresh copy of Windows, or Local reinstall to use the files already on the PC (faster, but may not include the latest updates).
7. Reset. Review the summary and select Reset. The PC restarts several times.

These steps were written for Windows 11 22H2 and later. The full page with the other versions and what each result means: Reinstall Windows without losing files

If the PC still crashes or restarts: what to check instead of Event 86

Many readers find Event 86 while looking for the cause of a crash, as in the question above. The event is often the last row before a restart only because Windows writes it at startup. Look at what happened in the minute before the crash.

• Restarts with no warning. In Windows Logs > System, find Kernel-Power 41 and EventLog 6008 and read the errors just before them.
• Blue screens. Look for BugCheck 1001 and note the stop code.
• Memory overclock. If XMP, EXPO or DOCP is on in the BIOS, set it back to default for a test. Unstable memory settings cause random restarts.
• Memory errors. Run Windows Memory Diagnostic: How to test your RAM with Windows Memory Diagnostic
• Power supply. Some users report a power supply too weak for the graphics card. Check both against the makers' specifications.
• What to send to support. The Windows version from winver, the BIOS version from msinfo32 and the XML of the Kernel-Power 41 event.

How to keep SCEP certificate enrollment errors from coming back

Frequently asked questions

What does SCEP Certificate enrollment initialization failed mean?

It means Windows tried to get an attestation certificate for the TPM from Microsoft and the request failed at its first step. The event is number 86 from the CertificateServicesClient-CertEnroll source. The address in the text, under microsoftaik.azure.net, is built from your TPM's key ID, and the service answers that no such authority exists. On a home PC nothing depends on this certificate, so the event is a failed request in the log rather than a fault.

What is Simple Certificate Enrollment Protocol (SCEP)?

SCEP is a standard protocol that lets a device ask a certificate server for a certificate over HTTP. Companies use it, for example through Microsoft Intune, to give laptops certificates for Wi-Fi and VPN. Windows also uses it to request a TPM attestation certificate from Microsoft, and that is the request behind this event. The word SCEP in the event does not mean that your PC is managed by a company.

Can Event 86 cause crashes, freezes or random restarts?

Nothing we read shows that it can. It is a failed web request written to the log. Users on Microsoft Q&A who tried every suggested fix, including BIOS updates, still had crashes, which points to another cause. The row often sits just before a restart because Windows writes it at startup. Read Kernel-Power 41 and EventLog 6008 and the errors just before them, and test memory settings and the power supply as the still-broken section shows.

Why does the address say AMD-KeyId or INTC-KeyId?

The prefix names the maker of the TPM, and the long number after it is the TPM's key ID. AMD-KeyId belongs to an AMD firmware TPM, INTC-KeyId to an Intel firmware TPM, and VMW-KeyId to the virtual TPM of a VMware virtual machine. The key ID is unique, so every PC shows its own address. Searching for your exact address finds the same problem as everyone else's. Microsoft Q&A moderators tie the AMD case to BIOS and chipset updates (Fix 2).

What does SCEP Certificate enrollment initialization for WORKGROUP mean?

WORKGROUP followed by your PC name and a dollar sign is the computer account the request ran for. Every PC that is not joined to a company domain is in a workgroup, and the default name is WORKGROUP. It does not mean a work network or an employer is involved. The cause and the fixes are the same as for the Local system version of the message. If you do have an old work account on the PC, see Fix 4.

Is SCEP certificate enrollment failed event 87 the same problem?

Searches for this page include a second spelling, SCEP Certificate enrollment for Local system via the same microsoftaik.azure.net address, and event 87 next to 86. Users report it in the same rows, with the same address. We could not confirm the exact text of event 87 from a Microsoft page. If it carries the same microsoftaik.azure.net address, the cause and the fixes here apply to it.

Should I clear or turn off the TPM to stop the error?

No, not for this event alone. A Microsoft Q&A moderator listed clearing the TPM, but users in the same thread still had the rows afterwards, and clearing removes keys that BitLocker, Windows Hello and some sign-ins use. Turning the TPM off breaks the Windows 11 requirement and can cause BitLocker recovery at startup. Stopping the task in Fix 3 ends the requests without touching the TPM, and it can be undone with one command.

I see SCEP enrollment failed on a company PC with Intune. Is it this?

Probably not. On a company PC, SCEP usually delivers Wi-Fi, VPN or email certificates from your organisation's server, and those failures have other addresses and error codes, such as 0x80094800. Microsoft has troubleshooting articles for administrators on that setup. This page covers the TPM attestation request to microsoftaik.azure.net on home PCs. On a managed PC, do not disable tasks or remove accounts; send the event text to your IT team.

Is it different on Windows 10 and Windows 11?

The event, its source and the cause are the same on both, and the fixes apply to both; the steps give the Windows 10 paths where they differ. Most recent reports come from Windows 11, often after an upgrade from Windows 10. Windows 10 left support on 14 October 2025 and gets no more fixes, so a change on Microsoft's side would reach Windows 11 only.

I see this error in another language. Is it the same?

Yes. The text is translated with Windows, but the event ID 86, the source CertificateServicesClient-CertEnroll and the microsoftaik.azure.net address stay the same. In German it is "Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung", and in Russian searches read "сбой регистрации сертификата SCEP локальная система через". This page is in English, but the cause and every fix apply, and the PowerShell commands work in any language.