Yeah, this one's a pain. You're trying to enroll a Windows device into Intune or Autopilot, and it throws 0X80094817 at you. The message says the endorsement key certificate is invalid. Most folks panic and think the TPM is dead. It's usually not. Let's fix it.
The Quick Fix: Clear the TPM (Yes, Really)
In 90% of the cases I've seen, the TPM has a stale or corrupted EK certificate. The TPM hardware itself is fine. Clearing it forces Windows to create a brand new EK and re-provision the certificate. You'll lose nothing important—BitLocker will need a recovery key if it was on, but that's about it.
- Open PowerShell as Administrator.
- Run
Clear-Tpm. If it prompts, accept. - Restart the machine. Let it boot fully.
- Open tpm.msc and verify the status says "Ready".
- Try enrollment again.
That's it. Most of the time, that clears the error. Why? Because during the TPM lifecycle, especially after a BIOS update or a failed Windows update, the EK certificate gets out of sync. Clearing the TPM rebuilds it from scratch. It's the equivalent of turning it off and on again, but at the hardware level.
Why This Works — The Technical Bit
The endorsement key is a key pair generated inside the TPM at manufacturing time. The public half is signed by the TPM vendor, and that signed blob is the EK certificate. Windows stores a copy in the registry and uses it for attestation during MDM enrollment. If that stored copy is missing, corrupted, or doesn't match the TPM's actual key, you get 0X80094817.
Clearing the TPM deletes the current EK and generates a new one. Windows then requests a new certificate from the TPM provider. It's a clean slate. No need to flash the BIOS or reinstall Windows.
When Clearing Doesn't Cut It — The Variations
Sometimes you clear the TPM and it still fails. Here's what to check next, in order.
Driver Issue
If you're on a Dell or Lenovo, the TPM driver might be out of date. Go to the OEM's support site, grab the latest TPM driver, install it, reboot. I've seen this fix the issue on Dell Latitude 5420s more times than I can count.
# Check current driver version
Get-Tpm | Select ManufacturerId, ManufacturerVersion
Compare that to the latest version on the OEM site. If it's older than a year, update it.
BIOS/UEFI Settings
Sometimes the TPM is set to "Hidden" or disabled in BIOS. That's a different error though. But if you've recently had a BIOS reset or update, the TPM state might have flipped to "Disabled". Go into BIOS, find the TPM settings (often under Security or Trusted Computing), and make sure it's set to "Enabled" or "Available". Also check if there's a "TPM Status" option—set it to "Enabled" there too.
Registry Key Issue
In rare cases, the registry key that stores the EK certificate is corrupt. You can delete it and let Windows rebuild it. This is a last resort—only do it if the above fails.
# Delete the EK registry key (backup first!)
reg delete HKLM\SOFTWARE\Microsoft\TPM\EK /f
# Reboot and let Windows recreate it
After reboot, check tpm.msc again. If it says "Ready", you're good. If not, you might have a genuinely dead TPM—but that's like a 2% chance.
Prevention — So You Don't See This Again
This error tends to appear after BIOS updates or Windows feature updates. To avoid it:
- Always install the latest TPM firmware from your OEM before a big Windows update.
- If you clear the TPM, make sure BitLocker recovery keys are backed up first. You'll need them.
- Keep your BIOS/UEFI up to date—but do it deliberately, not on a whim.
- For Autopilot, make sure the device is registered correctly in the OEM's portal first. Sometimes the device hash is stale.
The bottom line: 0X80094817 is almost always a fixable software issue. Clear the TPM, update the driver, and move on. You'll be back to enrolling in no time.