Update for TPM 2.0 for COD/BF6

[Alan J T]

MSI have started to release a Patched BIOS for ALL the AM4 Motherboards, this is to remedy the COD/BF6 Game TPM error message.
Please keep an eye on the MSI web page of your motherboard for the BIOS updates.
Before you apply the BIOS Update, you will need to disable TPM in the BIOS to prevent problems with Windows Hello and Windows Activation errors.

--Edit Sept.12--

- Turn off/backup/suspend bitlocker before BIOS flash (if you use the feature)
- Disable TPM in BIOS before BIOS flash
BIOS are available here
https://sites.google.com/view/msi-bios-update/menu/motherboard

These BIOS are coming straight from MSI, but if you have any concern, wait for official website upload version.
Update BIOS at your own discretion.
If BIOS for your board is not here or on the website, it means it is not ready yet.
Known AMD Limitation
- AMD does not support Ryzen 1000, 2000 TPM update
- AMD B550, A520 + Picasso will not work with TPM-B due to AMD limitation

Have put in a request to MSI to verify if we have the correct TPM
As users are reporting, TPM Firmware was updated to 3.94.0.5 and not the latest version 3.94.2.5
I may not have this info till sometime on Monday at the earliest.

EDIT 15-Sep 1500 Hours AU (+10GMT)
BIOS updates for 300, 400 and 500 Series Chipsets on the Support Site will contain TPM Patch 3.94.2.5 when available to download
Check Bios Notes to verify

--Edit Sept.30--
AM4 BIOS are all up to date with TPM-B Support

 

[cnardo153002d1]

All: I finally resolved my Call of Duty / RICOCHET attestation problem after nearly three months of troubleshooting, and I wanted to document it here because in my case the MSI BIOS and AMD fTPM were not actually the remaining problem.

My system is an MSI X570-A PRO with AMD fTPM. TPM 2.0, Secure Boot, UEFI, measured boot, and the current BIOS/fTPM configuration were all healthy. Windows itself reported the machine as capable of attestation, yet Call of Duty continued to fail secure attestation.

The eventual problem appeared to be an existing application-specific TPM key container named ActivisionAIK that had become stale or otherwise invalid.

I did NOT clear the TPM, reset Secure Boot keys, reinstall Windows, or change hardware.

Open PowerShell as Administrator.

Step 1 — Confirm that the Activision-specific AIK already exists:

certutil.exe -csp "Microsoft Platform Crypto Provider" -key ActivisionAIK

IMPORTANT: If ActivisionAIK does NOT exist at this point, STOP. This probably is not the same failure mode. I would not recommend deleting or resetting unrelated TPM material trying to force this fix.

In my case, ActivisionAIK already existed even though Activision's own broker logs showed failed AIK enrollment attempts earlier in the history of the problem.

Step 2 — Delete ONLY the application-specific ActivisionAIK container:

certutil.exe -csp "Microsoft Platform Crypto Provider" -delkey ActivisionAIK

This does not clear the TPM. It removes only the named ActivisionAIK container.

Step 3 — Verify that the old container is actually gone:

certutil.exe -csp "Microsoft Platform Crypto Provider" -key ActivisionAIK

In my case, the expected result was:

0x80090016 NTE_BAD_KEYSET
Keyset does not exist.

That was intentional. At this point I knew the old application-specific key had actually been removed.

Step 4 — Re-enroll a fresh ActivisionAIK:

cmd.exe /c 'certreq.exe -enrollaik -f -q -machine -config "" ActivisionAIK'

Successful enrollment on my machine returned:

PkiStatus(0): SCEPDispositionSuccess
EnrollStatus(1): Enrolled
HTTP/1.1 200 OK
Key = ActivisionAIK
The operation completed successfully. 0x0
Immediately afterward I reran the Call of Duty Secure Attestation Wizard.

The same machine that had been failing attestation immediately changed to:

SYSTEM COMPLIANT

I then verified the result in both my Battle.net Call of Duty installation and the Xbox/Microsoft Store MW4 beta, including before and after a Windows restart. The attestation failure did not return.

The important distinction here is that this was not a general TPM repair.

My TPM was already ready, TPM 2.0 was active, Secure Boot was enabled, UEFI was correct, and the MSI/AMD firmware side had already been updated. The remaining failure appeared to be the persisted Activision-specific AIK identity back from the June digital handshake despite multiple handshakes since then being fine between my PC, Activision, and Azure.

If your TPM/Secure Boot configuration is actually unhealthy, or ActivisionAIK does not already exist in Step 1, you likely have a different problem. For anyone who has already updated the appropriate MSI BIOS/AMD fTPM firmware and Call of Duty still reports an attestation failure, particularly when the normal TPM and Secure Boot checks are passing, this may be worth checking before clearing the entire TPM or reinstalling Windows.

Attached are two screenshots of the Attestation Wizard (August version) before and after running the above 4 steps in PowerShell.

 

[Jarous1]

Great, finally a solution that actually works!
Except that Activision itself should be the one to address this—and, most importantly, spread the word far and wide—rather than leaving it up to those “affected” users, who are actually PAYING for these games

 

[Alan J T]

All: I finally resolved my Call of Duty / RICOCHET attestation problem after nearly three months of troubleshooting, and I wanted to document it here because in my case the MSI BIOS and AMD fTPM were not actually the remaining problem.

My system is an MSI X570-A PRO with AMD fTPM. TPM 2.0, Secure Boot, UEFI, measured boot, and the current BIOS/fTPM configuration were all healthy. Windows itself reported the machine as capable of attestation, yet Call of Duty continued to fail secure attestation.

The eventual problem appeared to be an existing application-specific TPM key container named ActivisionAIK that had become stale or otherwise invalid.

I did NOT clear the TPM, reset Secure Boot keys, reinstall Windows, or change hardware.

Open PowerShell as Administrator.

Step 1 — Confirm that the Activision-specific AIK already exists:

certutil.exe -csp "Microsoft Platform Crypto Provider" -key ActivisionAIK

IMPORTANT: If ActivisionAIK does NOT exist at this point, STOP. This probably is not the same failure mode. I would not recommend deleting or resetting unrelated TPM material trying to force this fix.

In my case, ActivisionAIK already existed even though Activision's own broker logs showed failed AIK enrollment attempts earlier in the history of the problem.

Step 2 — Delete ONLY the application-specific ActivisionAIK container:

certutil.exe -csp "Microsoft Platform Crypto Provider" -delkey ActivisionAIK

This does not clear the TPM. It removes only the named ActivisionAIK container.

Step 3 — Verify that the old container is actually gone:

certutil.exe -csp "Microsoft Platform Crypto Provider" -key ActivisionAIK

In my case, the expected result was:

0x80090016 NTE_BAD_KEYSET
Keyset does not exist.

That was intentional. At this point I knew the old application-specific key had actually been removed.

Step 4 — Re-enroll a fresh ActivisionAIK:

cmd.exe /c 'certreq.exe -enrollaik -f -q -machine -config "" ActivisionAIK'

Successful enrollment on my machine returned:

PkiStatus(0): SCEPDispositionSuccess
EnrollStatus(1): Enrolled
HTTP/1.1 200 OK
Key = ActivisionAIK
The operation completed successfully. 0x0
Immediately afterward I reran the Call of Duty Secure Attestation Wizard.

The same machine that had been failing attestation immediately changed to:

SYSTEM COMPLIANT

I then verified the result in both my Battle.net Call of Duty installation and the Xbox/Microsoft Store MW4 beta, including before and after a Windows restart. The attestation failure did not return.

The important distinction here is that this was not a general TPM repair.

My TPM was already ready, TPM 2.0 was active, Secure Boot was enabled, UEFI was correct, and the MSI/AMD firmware side had already been updated. The remaining failure appeared to be the persisted Activision-specific AIK identity back from the June digital handshake despite multiple handshakes since then being fine between my PC, Activision, and Azure.

If your TPM/Secure Boot configuration is actually unhealthy, or ActivisionAIK does not already exist in Step 1, you likely have a different problem. For anyone who has already updated the appropriate MSI BIOS/AMD fTPM firmware and Call of Duty still reports an attestation failure, particularly when the normal TPM and Secure Boot checks are passing, this may be worth checking before clearing the entire TPM or reinstalling Windows.

Attached are two screenshots of the Attestation Wizard (August version) before and after running the above 4 steps in PowerShell.

Will ask our Contact to take a look. Thanks for the detailed post
Perhaps they will get the chance to slap Activision around the head with it.

 

[cnardo153002d1]

Will ask our Contact to take a look. Thanks for the detailed post
Perhaps they will get the chance to slap Activision around the head with it.

I sent the more detailed log to my Activision ticket I've had since June. Happy to send direct to your team via e-mail as well. If interested, please send me a private message with the preferred contact method to do that.

Regards,
-Christian

 

[Alan J T]

I sent the more detailed log to my Activision ticket I've had since June. Happy to send direct to your team via e-mail as well. If interested, please send me a private message with the preferred contact method to do that.

Regards,
-Christian

It's all ready been passed on to the Development team.
If they require more, I will get a message. and contact you if that happens