Event ID 87 from Microsoft-Windows-CertificateServicesClient-CertEnroll records a certificate-enrollment response, usually involving a TPM-attestation (AIK/SCEP) request. It is not, by itself, proof that the TPM has failed. Open the full event and identify its URL or service, enrollment stage, HTTP status, error code and server message before choosing a fix: a reported HTTP 429 means service-side rate limiting, while a reported HTTP 400 can mean the specific P-256 ECC AIK request was rejected.
What Event ID 87 actually records
CertificateServicesClient-CertEnroll is the Windows component that requests and renews certificates. In the Event ID 87 cases discussed by Microsoft Q&A users, the operation was TPM Attestation Identity Key (AIK) certificate enrollment through the Simple Certificate Enrollment Protocol (SCEP). The client sends an attestation request to an enrollment service and records the service’s response in Event Viewer.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters. Event ID 87 identifies the logging event, not a single universal fault. Two reports in the same Microsoft Q&A discussion contained different HTTP responses and different server explanations. Treating every Event ID 87 as a bad TPM, corrupted certificate store or Windows file problem can lead to unnecessary and potentially disruptive repairs.
The word “every” in “error every logon” also does not change the diagnosis. A recurring entry means the enrollment operation is being attempted repeatedly; it does not reveal whether the request is being rate-limited, rejected because of its key type, or failing for another reason. The complete payload is the evidence you need.
#1 Best Overall
Read the complete event before changing anything
Start with the record Windows is actually writing, rather than an abbreviated message from a notification or screenshot.
- Press
Win, type Event Viewer, and open it. - Browse to Applications and Services Logs > Microsoft > Windows > CertificateServicesClient-CertEnroll. Open the channel that contains the entry, then select the Event ID 87 record.
- On the General tab, copy the entire message. Use Details > XML View as well if the General text truncates the URL, status or error code.
- Record the request stage (for example,
SubmitV2Attestation), the destination URL or service name, HTTP status, hexadecimal error code, public-key algorithm and the server’s response text. - Note whether the event is the only symptom or appears alongside a failed sign-in, BitLocker warning, security-processor error, device-enrollment problem or certificate-dependent application failure.
Do not infer a diagnosis from the number 87 alone. In the reported cases, the details that separated a temporary service response from a protocol incompatibility were the HTTP status and the server message.
Two documented responses that look similar but are not
| Event details reported | What that response means in that report | Practical next step |
|---|---|---|
SubmitV2Attestation: Too Many Requests; HTTP 429; error 0x801901ad |
A Microsoft external-staff moderator described the enrollment service as temporarily rate-limiting the AIK request. The supplied event did not, by itself, show TPM failure or certificate corruption. | Check whether any function is affected, verify TPM status, and monitor later attempts. Avoid destructive local changes aimed at “repairing” hardware. |
HTTP 400; error 0x80190190; “V2 Protocol AIK certificate requests with P-256 ECC public keys are not supported.” |
The server rejected that particular V2 AIK request because it used a P-256 elliptic-curve public key. The report identified a 256-bit key and the corresponding public-key algorithm OID. | Keep the exact message for IT or the device manufacturer. It is a protocol/key-compatibility response, not evidence that every ECC TPM or every Windows installation is affected. |
These figures are diagnostic values from individual Microsoft Q&A reports, not prevalence statistics. A different URL, status or message in your event can indicate a different failure mode.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCheck whether the TPM and security features actually work
Before attempting remediation, separate an informational Event Viewer entry from a functional security failure.
Windows Security status
Open Windows Security, choose Device security, and open the Security processor details or status page. Confirm whether Windows reports the security processor as working properly. If the page reports a problem, capture its message and any recommended action rather than clearing the TPM immediately.
Real-world checks
- Sign out and sign back in using the normal method. Record whether Windows Hello or another configured sign-in method still works.
- Check whether BitLocker remains enabled and whether Windows can unlock the system normally. Do not suspend or decrypt BitLocker merely because Event ID 87 appears.
- Open any organizational enrollment or VPN application that depends on a device certificate and see whether it reports an authentication or certificate error.
- Look for a new security-processor warning in Windows Security, not just the repeated Event Viewer entry.
If these functions work and Event ID 87 is the only indication, the Microsoft forum guidance is conditional monitoring, not a guarantee that every instance is harmless. If a security feature has stopped working, preserve the event details and escalate instead of assuming the log can be ignored.
What to do when the event says HTTP 429
HTTP 429 means “Too Many Requests.” In the Microsoft Q&A report, an external-staff moderator explained that the AIK enrollment service was temporarily rate-limiting the request. That is a remote service response; repeatedly resetting the local TPM cannot remove a server-side throttle.
- Confirm that your event actually contains HTTP 429 and
0x801901ad, rather than assuming all Event ID 87 records match the report. - Check Windows Security and the sign-in, BitLocker and organizational-enrollment functions listed above.
- Leave the enrollment task and TPM configuration unchanged while you monitor subsequent events. A later attempt may succeed after the service limit clears.
- If the event continues for an extended period or a certificate-dependent function fails, give IT the copied XML and timestamps so they can correlate the request with device-management and enrollment-service logs.
A 429 can recur at each attempted enrollment, which explains why the same-looking message may appear around repeated sign-ins or task runs. The recurrence does not convert a temporary server response into proof of a defective motherboard or TPM.
What to do when the event says HTTP 400 and P-256 is unsupported
The later Q&A report is materially different. Its server returned HTTP 400 (0x80190190) and explicitly said that V2 Protocol AIK certificate requests with P-256 ECC public keys were not supported. The report included a 256-bit P-256 key and its algorithm identifier.
Because the rejection names the request’s key type, troubleshooting should focus on compatibility among the Windows enrollment client, TPM-generated key and enrollment service. Do not generalize this one response into “ECC TPMs are broken” or “all P-256 keys fail.” The evidence establishes only that the particular request in that report was refused.
- Save the complete event, including the server message, algorithm OID, key length, URL and timestamp.
- Check whether the device is managed by an employer, school or other organization. Their enrollment policy may determine which AIK protocol or key type is expected.
- Ask the administrator or device manufacturer whether a BIOS/UEFI, TPM-firmware or policy update addresses that exact compatibility combination.
- Do not substitute a different key or clear existing TPM keys without an approved recovery plan; doing so can affect BitLocker, Windows Hello and device enrollment.
Check for manufacturer firmware updates
A Microsoft Q&A answer recommends checking the computer manufacturer’s support portal for device-specific BIOS/UEFI or TPM-firmware updates and checking the security-processor status in Windows Security. This is a diagnostic avenue, not proof that an update exists for every model or that installing one will change the enrollment response.
Recommended Free Tools
Use the exact model and hardware revision shown in Settings > System > About or the manufacturer’s identification utility. Read the release notes for TPM, security processor, attestation, certificate enrollment or platform-key changes. Follow the vendor’s power and backup requirements, and do not interrupt a firmware update. On a managed computer, obtain approval from IT first because firmware changes can be governed by organizational policy.
Best Value
Managed computers need an administrator’s decision
AIK and SCEP enrollment commonly support organizational trust, compliance and device authentication. If the computer belongs to an organization, contact its help desk with:
- the complete Event ID 87 XML and the event timestamp;
- the destination URL or service name, request stage and HTTP status;
- the hexadecimal error code and exact server message;
- the Windows edition and build, device model and TPM/security-processor status; and
- whether sign-in, BitLocker, VPN, Wi-Fi certificates or management enrollment are failing.
Ask before disabling, deleting or editing any enrollment task. A community post suggested disabling AikCertEnrollTask, but the Microsoft responses reviewed for this issue do not validate that as a general fix. Disabling it can suppress future enrollment attempts and hide a problem that an organization needs to see.
Why common “PC repair” actions are poor first choices
The documented responses are either a remote rate limit or a server rejection of a specific AIK request. Neither one is addressed by generic file-repair routines.
- Do not clear or reset the TPM as a first response. Clearing it removes keys and can require BitLocker recovery, Windows Hello re-enrollment and re-registration with management services.
- Do not buy replacement TPM hardware. Nothing in these reports demonstrates physical TPM failure.
- Do not run SFC or DISM solely for this event. Those tools repair Windows component files; they do not change a service’s HTTP 429 decision or make an unsupported P-256 request acceptable.
- Do not delete certificates or enrollment caches blindly. You can break certificate-dependent applications while leaving the server response unchanged.
- Do not disable security tasks to make Event Viewer quiet. Suppressing the event is not the same as completing AIK enrollment.
When monitoring is reasonable—and when to escalate
Monitor with no immediate change when
- the event is the only symptom;
- Windows Security reports the security processor as healthy;
- sign-in and BitLocker work normally; and
- the payload is consistent with the reported temporary 429 case or otherwise contains no functional failure.
Microsoft external-staff moderator Emma1-N wrote on July 25, 2026: “At this time, I recommend continuing to monitor future Windows updates. If no functionality is affected and the event only appears in Event Viewer, it is likely an informational entry related to the certificate enrollment process and may not require any action.” This is case-specific forum guidance, not a formal Windows support policy or a promise that an update will resolve every Event ID 87.
Escalate promptly when
- Windows Security reports a security-processor error;
- Windows Hello, BitLocker unlock, VPN, Wi-Fi or another certificate-dependent function fails;
- the event contains HTTP 400 with a key or protocol rejection and the device is managed;
- the same request fails for a sustained period with no successful enrollment; or
- you are being asked to clear the TPM, change firmware or disable an enrollment task without a documented recovery procedure.
A concise decision path
- Capture the payload. Confirm the provider, stage, URL, HTTP status, error code and server message.
- Classify the response. HTTP 429/
0x801901adis the reported rate-limit case; HTTP 400/0x80190190with the P-256 wording is the reported key-compatibility case. Anything else needs its own diagnosis. - Check impact. Verify Security processor status, sign-in, BitLocker and any organizational certificate function.
- Apply the least disruptive next step. Monitor an isolated, functioning system; check manufacturer firmware information; involve IT for managed systems or any functional failure.
- Preserve recovery options. Do not clear TPM keys, delete certificates or disable AikCertEnrollTask merely to stop the log entry.
The useful answer to “How do I fix SCEP certificate enrollment failed?” is therefore conditional: identify the response first. A temporary 429 may need observation and service-side resolution, while a 400 P-256 rejection requires compatibility or policy investigation. Event ID 87 alone cannot tell you which situation you have.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
