Windows 11 TPM AIK Enrollment Fails – HTTP 400 / 0x80190190 – Intel PTT

I’m experiencing a Windows TPM/AIK attestation failure despite TPM 2.0 and Secure Boot both functioning normally.

System:

• ASRock B860 Pro-A WiFi
• Intel Core Ultra 7 265F
• Windows 11 Home
• BIOS 3.32 / UEFI
• Intel PTT / TPM 2.0
• TPM firmware: 700.19.1011.2289
• Secure Boot: Enabled

Windows reports the TPM as present, ready, enabled, activated, owned, and capable of attestation. TPM diagnostics also report:

Ready For Attestation: True Is Capable For Attestation: True Clear Needed To Recover: False TPM Has Vulnerable Firmware: False

However, Windows measured-boot/attestation diagnostics report:

HealthStatus: Cannot be attested EkCertIsAvailable: false

The TPM Endorsement Key certificate is present and matches the TPM public key. The EK certificate issuer is:

CN=ODCA 2 CSME MTP PCH SVN 01 PTT CA

Windows AIK objects are present but do not have certificates associated with them.

The Windows scheduled task:

\Microsoft\Windows\CertificateServicesClient\AikCertEnrollTask

fails with:

0x80190190 (HTTP 400 Bad Request)

This is also preventing Call of Duty Secure Attestation from completing. Its diagnostic tool reports:

TPM 2.0: PASS Secure Boot: PASS Attestation Requisite: NOT MET

Attempting to generate a new attestation key results in:

New Key Failed to be generated – BIOS Firmware Update Recommended

I have already updated to the latest available motherboard BIOS and worked with the motherboard manufacturer to clear and reinstall the default Secure Boot keys. The required Microsoft 2023 Secure Boot certificates are present and Secure Boot remains active.

The issue began after the motherboard was replaced while the existing Windows installation/SSD was retained.

My main question: Does 0x80190190 combined with EkCertIsAvailable=false indicate that Windows/Microsoft's AIK enrollment service is unable to validate the Intel PTT EK certificate chain?

I have seen other recent reports involving the ODCA 2 CSME MTP PCH SVN 01 PTT CA issuer and similar HTTP 400 AIK enrollment failures.

I would prefer not to clear the TPM, reinstall Windows, or manually modify the Windows certificate stores unless one of those actions is confirmed to be appropriate for this specific condition.

Any guidance on additional Windows TPM/AIK diagnostics or whether this Intel PTT certificate chain is currently supported would be appreciated.