Event id 87 certificateservicesclient certenroll error every logon.

nobleflame said:

If MS fix the issue in a future update, will I need to enable this feature again or will MS do that automatically?

Click to expand...

Newer Monthly Updates probably won't change the Feature ID setting. What you can do after September's update, is try switching the setting to enabled, then reboot and check if the problem was really been fixed for your PC.

My understanding is some PC's have an older version of the TPM chip, so they will always throw Event ID 87 errors.
Or your TPM settings need to be reset. I'm not sure what's the safest answer on a reset, so just leave it alone.

garlin said:

Newer Monthly Updates probably won't change the Feature ID setting. What you can do after September's update, is try switching the setting to enabled, then reboot and check if the problem was really been fixed for your PC.

My understanding is some PC's have an older version of the TPM chip, so they will always throw Event ID 87 errors.
Or your TPM settings need to be reset. I'm not sure what's the safest answer on a reset, so just leave it alone.

Click to expand...

I actually did reset the TPM as a step to fix this issue. It didn't work. My PC is quite new (2.5 years old) and my MB is a Z790 MAG Tomahawk DDR5 (MSI board) on the latest bios.

I definitely think this is not a hardware issue on my part and instead something MS has to fix. I have saved a log of the steps I took to remove the error (thanks for this!) and I will enable the Feature ID setting after the Sep update as per your suggestion.

Thanks again!

Here's a very technical dive on the subject:
Why Intune Devices Became Noncompliant After the July Windows Update

You don't have to try understanding all the technical details, but skim over the parts where the author discusses what features are changed, and why different PC's will respond differently.

It's one of those "MS did something to improve security, but didn't realize so many chips don't work the same way in real life". Supposedly the new fix is better, but again there might be TPM's that still don't like the workaround. Which is why MS might have to keep tweaking it in future.