SCEP Errors Too Many Requests Code 87

mblack said:

TPM error - SCEP Certificate enrollment initialization failed

SCEP Certificate enrollment initialization for SYSTEMNAME via https://AMD-KeyId-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net/templates/Aik/scep failed:

{"Message":"The authority \"amd-keyid-578c545f796951421221a4a578acdb5f682f89c8.microsoftaik.azure.net\" does not exist."}

Click to expand...

Yes , on my rig also ( id=87 ) , same error , twice in eventviewer after every reboot .
Never seen before , untill latest winupd.............
Still searching HOW(??) to get rid of this worthless eventerror.........

pietcorus2 said:

Yes , on my rig also ( id=87 ) , same error , twice in eventviewer after every reboot .

Click to expand...

Not sure why you would get this on an Intel based system as it is an AMD error.

Look at the URL in the error.

KevTech said:

Not sure why you would get this on an Intel based system as it is an AMD error.

Look at the URL in the error.

Click to expand...

" De SCEP-certificaatinschrijving voor Lokaal systeem via https://intc-keyid-b066d9697f5d3a07...e58.microsoftaik.azure.net/templates/Aik/scep is mislukt: " ..............this is the message with id=87 , on my Dutch Win11 ( latest version)
and ; "
SubmitDone
Submit(Request): Too Many Requests
HTTP/1.1 429 Too Many Requests
Date: Thu, 16 Jul 2026 20:03:12 GMT
Content-Length: 17
Content-Type: text/HTML
Retry-After: 3
client-request-id: 776228ca-02e8-460d-b0d6-d85c78777499

Methode: POST(1047ms)
Fase: SubmitDone
Fout 0x801901ad (-2145844819

with source : CertificateServicesClient-CertEnroll

INTC is the NASDAQ stock symbol for Intel. So I guess Intel CPU's get the same errors.

garlin said:

INTC is the NASDAQ stock symbol for Intel. So I guess Intel CPU's get the same errors.

Click to expand...

Indeed , same error , AMD and Intel also ................
No solution still.....................!

Probably have to wait for MS to fix it, i recall the 'id 86' on amd systems which did not cause any issue (for me) at the time.
I'm down to 1 on start up for id 87 at the moment, no issues.

I might have figured it out but I need a point of refrence to your taskscheduler. What triggers do you have on your aikcertenrolltask have?

I feel like my task used to have two but now its just this one custom trigger. Any of yours the same or different?

Secrios said:

What triggers do you have on your aikcertenrolltask have?

Click to expand...

Mine is the same and I do not think that is the issue as the task completed successfully without any errors.

Result (0x0) = successfully completed without any errors

Just compared the task file with a task file before the update and they are identical so nothing has changed with the task.

Secrios said:

I might have figured it out but I need a point of refrence to your taskscheduler. What triggers do you have on your aikcertenrolltask have?
View attachment 176927
I feel like my task used to have two but now its just this one custom trigger. Any of yours the same or different?

Click to expand...

Wonder what will happen if we disable the Custom Trigger...........!
Is id=87 removed from eventviewer then...........??
Or should we disable the "Safe Boot" ?

On my machine this how I stopped the logging of this error in Even Viewer. I did this described below and stopped receiving the errors after two days. Apparently, it takes a few days to stop because the request is stored in kernel, Don't Try to Delete the Stored Request.
Also, do not mess with the other Task's in "CertificateServicesClient". Do not even touch those.

Why is this happening:
Because millions of PCs are installing the exact same update and hitting the exact same server simultaneously, Microsoft's cloud endpoints are overloaded and actively throttling your PC with the HTTP 429 "Too Many Requests" error.




1. Disable the Trigger in Task Scheduler.

If the Event Viewer spam continues you can safely disable the specific automated task responsible for hitting the clogged Azure endpoint.

If your computer is a Virtual Machine using vTPM, or a standard standalone machine not bound to an enterprise domain, you can safely disable the task.

Open Task Scheduler, Navigate to: Library > Microsoft > Windows > CertificateServicesClient. Right-click on AikCertEnrollTask and select Disable.



Disabling AikCertEnrollTask stops your machine from requesting that specific certificate, but it is not a problem for a personal PC.

The task is only responsible for the Attestation Identity Key (AIK) certificate from Microsoft's cloud servers. It does not stop your PC from getting other essential security updates.

Why Disabling It Is Safe.

Enterprise Only Feature: AIK certificate enrollment is used by large organizations using Microsoft Intune or Mobile Device Management (MDM). It helps companies prove a PC's hardware is secure before letting it access corporate networks.

No Impact on Windows Update: Disabling this task will not block your normal Windows Updates, defender definitions, or app store downloads.

No Impact on Local Security: Your TPM chip still functions perfectly. Features like Windows Defender, Core Isolation, and local file encryption do not need this cloud certificate to protect your PC.

What Happens to the Enrollment Request?

When disabled, your PC simply stops reaching out to the overloaded Microsoft server. The request is canceled entirely, which stops the background loops and prevents the Event ID 87 error from spamming your Event Viewer.

If your machine is a standalone, personal computer used at home, you can leave this task disabled permanently with zero negative side effects.

neldog said:

Why is this happing

Click to expand...

I think you meant happening.

The whole thing just smells of one big AI copy/paste post.

Thanks... sorry bad spelling correction. Fixed it.

I did not applied your fix (id=87) , but today the error id=87 is gone , rebooted twice ; no id=87 anymore...........
Have to check after latest update again , will let you know............

That's good. If you did not disable that task, and did not get the error on bootup, that means the microsoftaik.azure.net servers have cleared the backlog of request for that certificate.

You most likely will not receive the error again unless there is a new Windows CU in the feature that has another high amount of security updates. The July update had something like 570 vulnerabilities it patched. If that were to happen again, and Microsoft has not taken some kind of action to avoid future backlog of request to those servers, you may see the error again.

The good news is now you now know that the error is no big deal and will, in time, just stop logging it on its own like it did this time.

neldog said:

That's good. If you did not disable that task, and did not get the error on bootup, that means the microsoftaik.azure.net servers have cleared the backlog of request for that certificate.

You most likely will not receive the error again unless there is a new Windows CU in the feature that has another high amount of security updates. The July update had something like 570 vulnerabilities it patched. If that were to happen again, and Microsoft has not taken some kind of action to avoid future backlog of request to those servers, you may see the error again.

The good news is now you now know that the error is no big deal and will, in time, just stop logging it on its own like it did this time.

Click to expand...

After latest update , id=87 back again !!
AikCertEnrollTask switched off , but cant find the "trigger page" , deleted after could not disable this trigger ..........
Any idea..........

All you can do is just disable that one single task, you should take no other action. In time, (it may take a few days) the error will stop on its own. They will never come back if you keep that one task disabled.

I went back and enabled the task on my computer so I will receive the error again if this happens on another CU. My understanding of this issue is, when you see this error logged, there is no problem with your computer, it is simply saying that the azure.net servers are too busy handling all the requests coming in to validate that enterprise certificate - which most standalone computer don't really need. But whether that task is enabled or disabled, sooner or later, that certificate, needed or not, will get validated once the backlog on those Microsoft servers is cleared.