0x80090016 is NTE_BAD_KEYSET — "Keyset does not exist". The cryptographic provider was
asked to open a key container that is missing or unreadable. In Intune SCEP scenarios this
usually points at damaged TPM key storage or machine key files that were deleted or have
broken permissions.
0x80090016
NTE_BAD_KEYSET: keyset does not exist
What it means
Common causes
TPM key storage is in a bad state (interrupted firmware update, cleared TPM with stale references, hibernation/fast-startup edge cases).
Machine key files under
%ProgramData%\Microsoft\Cryptowere deleted by cleanup tooling or have broken ACLs.The enrolment was interrupted between key generation and certificate installation, leaving a dangling reference.
How to fix it
Check TPM status with
Get-Tpm— if it reports not ready or owner authorisation problems, clear the TPM fromtpm.msc(suspend BitLocker first; TPM-protected keys and Windows Hello registrations are destroyed).Verify permissions on
%ProgramData%\Microsoft\Crypto\Keysand...\Crypto\RSA\MachineKeysmatch a healthy device.Delete the failed certificate request state by removing any stale pending request in
certlm.msc> Certificate Enrollment Requests, then sync the device to retry.