Windows 10: TPM 2.0 Error with Every Boot

I installed a TPM in my home computer recently. It runs Windows 10, version 2004, build 19041.388 (64-bit) using a Local Account. The motherboard is an ASUS X99 Deluxe with the latest BIOS. I have updated the Intel ME firmware to the latest version. And I have also updated the firmware on the TPM to the latest version. All these updates were successful.

According to Windows Security, the TPM is functioning properly and is ready for storage and attestation. Likewise, tpm.msc shows that the TPM is ready for use. However, with every boot I get the following error in Event Viewer. It seems to be saying that attestation with a Microsoft server is failing.

I have cleared the TPM multiple times, and it makes no difference. And I know that I can disable the task that that is failing (AikCertEnrollTask), but I would really like to solve the underlying issue. Anyone have an idea? I am stumped!

CertificateServicesClient-CertEnroll: Event ID 87

SCEP Certificate enrollment for Workgroup\OfficePC$ via https://IFX-KeyId-XXXXXXXXXXX.micros...lates/Aik/scep failed:
.....
TPM 2.0: Public and sensitive portions of an object are not cryptographically bound. 0x802800a5 (-2144862043)

--D. Miner

:)

 

BitLocker On TPM ver 2.0

Hey all.

I hope that i'm asking this at the right area of this Forum.

I have a DELL Latitude 5480 with Win10 pro on it.

After enabling BitLocker, BitLocker asking for a recovery key on every reboot.

I've found that BitLocker cannot work properly with TPM ver 2.0, (Dell Latitude 5480 comes with TPM version 2.0).

After downgrading TPM, from ver 2.0 to ver 1.2, BitLocker works smoothly.

Any solution for BitLocker on TPM ver2.0?

Thank in advance.

 

Bitlocker - Win 10 - TPM 2.0 - Legacy Mode

According to here you need to boot in UEFI to configure bitlocker then you can change to CSM.

Pre-Provision Bitlocker - TPM 2.0 - SCCM 1610

 

Unable to turn bitlocker on - TPM 2.0 is enabled but is not being recognised

Hi,

My Surface Pro 3 recently started asking me to enter BitLocker recovery keys on every start-up (I believe this was because on one occasion I accidentally tried booting the machine with a USB stick connected). To avoid having to enter BitLocker recovery keys
on every startup I turned off encryption.

I would now like to turn the encryption back on, but when I attempt to turn BitLocker back on (via Control Panel -> System and Security -> Bitlocker Drive Encryption) I get an error message that the device cannot use a Trusted Platform Module.

Within Trusted Platform Module (TMP) on Local Computer I get a message saying that Compatible TPM cannot be found.

I have followed various threads in this and other forums in an error to resolve this issue. I have confirmed that Trusted Platform Module 2.0 is enabled (via Device Manager and in BIOS settings). I have tried to initialise the TPM, but there is no initialization
option showing in the 'Trusted Platform Module (TMP) on Local Computer' tool.

Presumably since encryption was previously enabled on this machine the TPM 2.0 must have been recognisable and I have confirmed that there have been no firmware or other updates applied since the encryption was working - so I am now stumped by the fact
that turning encryption off seems to now be preventing me from turning it back on.

Any suggestions would be much appreciated. Thanks.