Event ID 86: How to Identify the Source and Fix Errors

You're scanning through Event Viewer when a red Error catches your eye: Event ID 86. For a moment, your brain jumps ahead to the worst-case scenario — is the PC dying? Did a server get compromised?

Before you start uninstalling drivers or planning an emergency rebuild, take a breath. In 15 years of working with Windows internals and certificate infrastructure, I've learned that Event ID 86 is not one fixed error. The meaning — and the urgency — changes completely depending on the event's Source field. Sometimes it's a harmless log entry you can safely ignore. Other times, it's a genuine signal that something in your PKI environment needs your attention.

In this guide, I'll show you how to identify the source of an Event ID 86 in under a minute, and then walk you through the exact fix for the most common scenarios.

What Exactly Is Event ID 86 in Windows Event Viewer?

Every entry in the Windows Event Log carries two critical attributes: an Event ID and a Source. The ID tells you which type of event occurred; the Source tells you who recorded it. In the case of Event ID 86, that distinction matters more than almost any other log entry I know.

I've seen Event ID 86 attributed to at least three very different components, each requiring a different response. The number alone is like a street address without a city — it gives you a starting point, but you can't act on it until you know the full picture.

Understanding Event ID 86 in the Windows Event Log

Most of the time, Event ID 86 appears in the Application log with a severity of Error. The event is commonly associated with the source Microsoft-Windows-CertificateServicesClient-CertEnroll — a built-in Windows component responsible for handling SCEP (Simple Certificate Enrollment Protocol) requests.

When that source logs Event ID 86, the EventData section typically contains several useful fields:

• Context — the account or system that attempted enrollment
• Url — the SCEP endpoint that was contacted
• MessageText — a human-readable description of the failure
• Method — the SCEP operation (often GetCACaps, which is the first step in any SCEP request)
• Stage — where in the handshake the failure happened
• ErrorCode — the underlying Windows/WinHTTP error

The Details tab in Event Viewer gives you these fields in both a friendly view and raw XML. I always tell people to grab the XML version — it prevents the occasional truncation that happens in the General tab and gives you the full picture.

Top 3 Sources of Event ID 86 (and Why You Should Care)

There are three sources I encounter most frequently in the field:

1. Microsoft-Windows-CertificateServicesClient-CertEnroll — This is by far the most common. It typically indicates a failed SCEP enrollment attempt, often related to TPM attestation or AIK (Attestation Identity Key) certificate requests.
2. Microsoft-Windows-CertificationAuthority — This source appears in enterprise environments running Active Directory Certificate Services (AD CS). It usually points to a certificate request or key archival problem on the CA itself.
3. AMD-related driver or system entries — On AMD systems, particularly those with fTPM enabled, Event ID 86 can surface when a driver or chipset component tries to contact a Microsoft cloud endpoint that no longer exists or has changed.

Each of these sources leads down a completely different troubleshooting path. That's why I always start with the source identification before I do anything else.

How to Find the Source of Event ID 86: A 50-Second Checklist

If you're looking at an Event ID 86 right now, here's the fastest way to figure out what you're dealing with.

Step-by-Step: View Source and Event Qualifier in Event Viewer

1. Press Win + R, type eventvwr.msc, and press Enter.
2. Navigate to Windows Logs > Application.
3. Find the entry with Event ID 86 — you can use the Filter Current Log option on the right panel to narrow things down.
4. Look at the Source column. Write down the exact source name — this is the single most important piece of information.
5. Click the event, then open the Details tab and switch to XML view. Copy the EventData section, especially the Url, MessageText, and ErrorCode fields.

One thing I see people miss constantly: the Event Qualifier field. When it's present, it shows up in the XML as a long decimal number (for CertEnroll Event ID 86 events, it often appears as 3260678144). It looks intimidating but it's really just an encoded value — note it down if it's there, but don't spend too much time analyzing it. The Source field is what matters.

Event ID 86 Source Lookup Table

Here's a quick reference table to help you interpret what you're seeing:

How to Fix Event ID 86 from CertificateServicesClient-CertEnroll

The CertificateServicesClient-CertEnroll source is responsible for the majority of Event ID 86 cases I've investigated. This component handles SCEP enrollment within Windows, and the event is typically logged when the first SCEP operation — GetCACaps — fails.

This becomes a problem most often when Windows tries to enroll an AIK certificate. Windows machines with a compatible TPM will periodically attempt to obtain an AIK certificate from a Microsoft cloud service. That enrollment happens over SCEP, and if the machine can't reach the endpoint, you get Event ID 86.

Fix SCEP Enrollment Network Errors (ERROR_WINHTTP_NAME_NOT_RESOLVED / 0x80072ee7)

If the event details show error code 0x80072ee7, that maps to WinHTTP error 12007 — ERROR_WINHTTP_NAME_NOT_RESOLVED. In plain English: the machine couldn't resolve the hostname in the URL.

This is common in a few situations:

• A machine on its first boot was offline or had no internet connection when the enrollment task ran.
• A proxy or VPN is intercepting and blocking the SCEP request.
• DNS servers are returning stale or incorrect results for the Microsoft endpoint domain.

To diagnose, open Command Prompt and run:

nslookup <hostname-from-the-Url-field>

If DNS resolves correctly, temporarily disable any proxy or VPN and check whether the endpoint is reachable with Test-NetConnection <hostname> -Port 443.

Here's the part that surprises people: in a test environment or a freshly imaged machine, this error may simply mean the computer was offline during its first enrollment attempt. Windows retries at irregular intervals, so the next attempt can succeed on its own. I've lost count of how many Event ID 86 tickets I've closed that resolved themselves within 24 hours.

Fix vTPM AIK Enrollment Failures on Windows 11 VMs

Windows 11 virtual machines with virtual TPM (vTPM) enabled have a known tendency to produce Event ID 86. The guest OS tries to auto-enroll an AIK certificate via SCEP, but the endpoint it's calling doesn't actually exist.

VMware's KB 414601 documents this scenario on ESXi 8.x: the VM logs an error against a URL that includes a vmw-keyid prefix, with a message like "The authority ... does not exist." I encountered this on a VDI pilot once — every single Windows 11 desktop was logging the same Event 86 at first sign-in. Hundreds of identical errors, all harmless.

The key insight is that this is not a TPM hardware failure. It's a configuration mismatch between the guest OS, the virtual TPM, and Microsoft's cloud AIK endpoint. The virtual TPM generates an EKCert with attributes that produce a URL fragment pointing to a non-existent authority, and Windows dutifully tries to use it.

The right response? Check whether anything in your environment actually consumes AIK certificates. For most workloads — including standard VDI and desktop usage — the answer is no. If that's the case, the event is noise.

Disable AikCertEnrollTask When No Application Needs AIK Certificate

If you've confirmed that no application on the system uses the AIK certificate, you can disable the scheduled task that triggers these attempts:

1. Press Win + R, type taskschd.msc, and press Enter.
2. Navigate to Task Scheduler Library > Microsoft > Windows > CertificateServicesClient.
3. Locate AikCertEnrollTask.
4. Right-click it and select Disable.

That's it. The task will stop triggering future enrollment attempts, and Event ID 86 should stop appearing.

I'd add one caution: don't disable this task on a machine where an application genuinely depends on TPM attestation. If you later deploy software that requires AIK certificates, re-enable the task and let Windows manage the lifecycle.

Windows Server: CertificationAuthority Event ID 86 in AD CS Environments

If you're an enterprise IT admin, the source you're probably seeing is Microsoft-Windows-CertificationAuthority — and this is a very different animal from the CertEnroll case.

What Does CertificationAuthority Event 86 Mean in AD CS?

Event ID 86 with the Microsoft-Windows-CertificationAuthority source is tied to Active Directory Certificate Services. In this context, it typically means the CA encountered a problem processing a certificate request — often related to key archival or certificate template configuration.

The message text usually references a specific certificate template, a key archival setting, or a CA configuration issue. This is a deliberate signal, not background noise, and it should be treated seriously in any production PKI environment.

Step-by-Step AD CS Troubleshooting for Event 86

Here's the troubleshooting sequence I recommend for CertificationAuthority Event 86:

1. Confirm the CA service is healthy. Open Services and verify that Active Directory Certificate Services is running, then open certsrv.msc and confirm the CA can enumerate its issued certificates.
2. Check the failed requests queue. In the CA snap-in, look at the Failed Requests folder. The failed request that triggered Event 86 will often have a matching entry there with a specific error.
3. Correlate with other CA warnings. Check the Application log for other CA-related warnings or errors that appeared in the same minute as Event 86. In my experience, Event 86 rarely arrives alone — it's usually part of a small cluster of related log entries.
4. If key archival is enabled, verify your Key Recovery Agent (KRA) certificates. A common cause of Event 86 in AD CS is a missing or expired KRA certificate. When key archival is enabled but no valid KRA cert exists, the CA cannot archive private keys and will reject enrollment requests.
5. Review template and security permissions. Make sure the requesting machine or user has the Enroll permission on the target certificate template, and that the template is properly configured for the CA to issue.

After making any changes, submit a test certificate request from a clean account and watch the event log to confirm Event 86 doesn't reappear.

AMD Chipset Driver Event ID 86: Fix and Prevention

The AMD-related version of Event ID 86 is the one that confuses people the most, because it's often the least severe.

Why AMD Chipset Drivers Trigger Event ID 86

On some AMD systems, particularly those with fTPM enabled, an Event ID 86 can appear at startup with a source that points back to an AMD chipset component or driver. From what I've seen on forums and in my own testing, the underlying cause is usually a driver trying to reach a Microsoft server endpoint whose address has changed or no longer exists.

The event details frequently still reference microsoftaik.azure.net in the URL — the same AIK endpoint used by the CertEnroll component. In effect, the AMD platform is attempting a TPM-related attestation check, and the communication fails.

Here's the reassuring part: this is almost never a sign of hardware failure. Your CPU and memory are fine. It's a communication error between a software component and an obsolete or unreachable endpoint.

I've had this exact event appear on my own AMD test bench, and the system ran perfectly stable for months. If you see this and there are no other symptoms, it's reasonable to deprioritize it.

Update AMD Chipset Drivers to Eliminate Event 86

The standard remedy is straightforward:

1. Visit amd.com or your system manufacturer's support page.
2. Download the latest AMD Chipset Software for your platform.
3. Run the installer. If it offers a Factory Reset option, use it — this removes old driver remnants that may carry the stale endpoint reference.
4. Restart the machine.

After rebooting, open Event Viewer and check whether new Event 86 entries are being created. In most cases, the update resolves the issue. If the event persists but the system is stable, it can safely be left alone.

Is Event ID 86 Causing My Computer to Freeze or Shut Down?

This is the question I see most often on Reddit and Tom's Hardware forums, and the answer matters more than most people realize.

Event 86 Is Usually a Symptom, Not the Root Cause

A while back, a client was convinced that Event ID 86 was crashing their server. The event appeared in the log right before the machine rebooted, and for them, that was enough evidence. But when I dug into the timing, the Event 86 entry was from a CertEnroll attempt that had failed hours before the actual crash. The two events were completely unrelated.

Here's a pattern I've seen repeat itself many times: Event 86 shows up in the event log, then a crash happens at some later point, and the event log viewer's default sorting makes it look like the two are connected. They usually aren't.

If your machine actually froze or shut down, look for Kernel-Power Event ID 41 — this event is recorded when the system restarts without a clean shutdown — or Service Control Manager Event ID 7034, which indicates that a service terminated unexpectedly. These are far stronger indicators of a real problem than Event 86 on its own.

Ask yourself this: did the machine freeze at the exact same second that Event 86 was written? If not, treat Event 86 as unrelated noise.

Hardware Diagnostic Checklist for Recurring Event 86 with Crashes

If you're seeing both Event 86 and actual system crashes, don't ignore the crashes. But don't blame Event 86 either. Run through this checklist instead:

• Run MemTest86 for at least 4 passes to rule out RAM problems.
• Check storage health with a SMART tool like CrystalDiskInfo or your SSD vendor's utility.
• Run Prime95 for 30 minutes while monitoring CPU temperatures with HWiNFO64.
• Make sure your BIOS/UEFI and chipset drivers are up to date.

Event 86 alone is insufficient evidence of a hardware defect. Use the crash dumps and the Reliability Monitor timeline to identify what changed around the time of the failures.

Related Event IDs to Watch with Event 86 on Windows 10 & 11

If you're troubleshooting Event 86 on a Windows 10 or Windows 11 machine, there are a few related event IDs you should be aware of.

What Do Event ID 87, 41 and 7034 Mean?

• Event ID 87 — Often appears alongside Event 86 from the same CertificateServicesClient-CertEnroll source. Both events belong to the same SCEP enrollment family and typically point to the same root causes. When you see 86 and 87 logged together, treat them as a single incident rather than two separate problems.
• Event ID 41 (Kernel-Power) — This event is recorded when Windows restarts without a proper shutdown. It's a much stronger signal of a power, thermal, or hardware problem than Event 86. If you're chasing shutdowns, start here.
• Event ID 7034 — Logged by Service Control Manager when a service terminates unexpectedly. It tells you which service misbehaved, which gives you a direct lead to investigate.

How to Correlate Event Logs to Determine the Real Problem

The key to good event log analysis is correlation, not isolation. I use a simple routine:

Open Reliability Monitor by running perfmon /rel — it gives you a timeline of system failures in a readable format. Then filter the Application log for Event 86 and compare the timestamps against any Event 41 or 7034 entries. Finally, check the System log for disk, network, or driver warnings that occurred immediately before the crash.

Look for patterns. Does Event 86 fire at every boot, or only when a specific application runs? Is it tied to a network connection event? Does it stop appearing after you connect to a different network?

That kind of evidence tells you far more than any single event ID.

Frequently Asked Questions

What is Event ID 86 in Windows?

Event ID 86 is a Windows Event Log entry whose meaning depends on its Source field. The most common source is Microsoft-Windows-CertificateServicesClient-CertEnroll, which indicates a SCEP or AIK certificate enrollment failure. It can also appear from the Microsoft-Windows-CertificationAuthority source (indicating an AD CS issue) or from AMD-related driver entries.

Is Event ID 86 a critical error?

Not necessarily. Event Viewer marks it as Error, but its severity depends entirely on the context:

• Often benign: A CertEnroll AIK enrollment failure on a machine that was offline during first boot.
• Potentially critical: A CertificationAuthority Event 86 in an enterprise AD CS environment, especially one with key archival enabled.
• Usually harmless: An AMD-related Event 86 on a stable system.

If the machine is running fine and the source is CertEnroll or AMD, you can usually deprioritize it. If the source is CertificationAuthority, investigate it.

How do I fix Event ID 86?

There is no single universal fix. First, identify the source using the checklist above, then apply the source-specific fix:

• CertEnroll source: Check network/DNS connectivity to the SCEP endpoint, verify the machine can reach the URL in the event details, or disable the AikCertEnrollTask if no application needs AIK certificates.
• CertificationAuthority source: Review the AD CS configuration, check failed requests, verify the Key Recovery Agent certificate, and confirm template permissions.
• AMD-related source: Update the AMD chipset drivers to the latest version.

Does Event ID 86 cause Windows shutdown or crashes?

In the vast majority of cases, no. Event ID 86 is a symptom of a network, driver, or certificate-enrollment communication issue — not a shutdown trigger. If your machine is crashing, look for Event ID 41 (Kernel-Power) or Event ID 7034 (service terminated unexpectedly) to find the real cause, and run standard hardware diagnostics if those events point in that direction.

What should I do immediately after seeing Event ID 86?

Here's a quick first-aid sequence:

1. Open the event details and write down the Source field.
2. Check the lookup table above to understand which scenario you're dealing with.
3. If the system is stable and the source is CertEnroll or AMD, update the relevant drivers or disable the AIK enrollment task if appropriate.
4. If crashes are occurring, look for Kernel-Power Event 41 and run hardware diagnostics rather than focusing on Event 86.

Conclusion

Event ID 86 is one of the most commonly misunderstood entries in the Windows Event Log. Because it appears under multiple sources with very different meanings, you can't rely on a single generic fix. The fastest path to resolution is always the same: find the Source, read the event details, then apply the fix that matches the context.

Most consumer-facing Event 86 logs are benign certificate-enrollment notices — they look alarming but require no action beyond a driver update or, in some cases, nothing at all. If you're an IT administrator, however, a CertificationAuthority Event 86 deserves your attention as a legitimate AD CS signal.

And if you're worried about crashes, don't let Event 86 distract you. Use Event ID 41 and 7034 to distinguish log noise from real system problems.

Still looking at an Event ID 86 and unsure what to do? Copy the Source, ErrorCode, and MessageText from Event Viewer and drop them into the comments below — include your Windows version and whether the system is stable, and I'll point you toward the right fix.