Quick Answers: Essential Attestation Facts
- The Core Issue: FACEIT’s kernel driver cannot authenticate that your boot state is genuine and unmodified.
- Most Common Hardware: AMD Ryzen motherboards running older AGESA firmware on firmware TPM (fTPM).
- Fastest Immediate Fix: Run
tpm.mscin Windows, execute Clear TPM, and reboot your system. - Account Impact: Non-punitive; your FACEIT profile and ELO are safe, but the Anti-Cheat will prevent matchmaking until cleared.
Why Does FACEIT Anti-Cheat Require TPM Attestation?
To eliminate ring-0 kernel cheats, hypervisors, and direct memory access (DMA) hardware exploit cards, FACEIT mandates TPM 2.0 and UEFI Secure Boot on Windows 10 and Windows 11. Attestation is the cryptographic mechanism where your hardware proves its authenticity to an external verification server.
When the FACEIT Anti-Cheat client launches, it queries the Windows Health Attestation service. Your TPM module signs a cryptographic report using its hardcoded Endorsement Key (EK). If your operating system cannot contact the certificate authority, or if the hardware TPM chip hangs during the cryptographic signature generation, the timeout threshold expires and throws TPM attestation timed out.
Diagnostic Table: TPM Attestation Failure Modes & Fixes
| Attestation State / Code | Underlying Technical Failure | Targeted Action |
|---|---|---|
Attestation: Timed Out |
Motherboard firmware hangs or takes longer than 15 seconds to return EK certificates. | Flash the motherboard to the latest BIOS version containing newer AGESA/PTT microcode. |
Attestation: Not Ready |
Corrupted local TPM owner credentials or missing Platform Crypto Provider keys. | Clear the TPM module via Windows Security or the UEFI BIOS menu. |
Missing EK Certificates |
Windows cannot verify TPM manufacturer root certificates against Microsoft servers. | Run Windows Update to install all optional and hardware-specific cumulative updates. |
Service Disabled / Blocked |
Custom Windows debloater or modified OS stripped the Cryptographic/TPM services. | Re-enable CryptSvc in services manager or repair with official Windows ISO. |
How to Fix “TPM Attestation Timed Out” on FACEIT
Follow these progressive troubleshooting procedures tested directly against the FACEIT Anti-Cheat client:
1. Clear the TPM Security Processor
Flushing the TPM resets corrupted cryptographic state keys and forces Windows to renegotiate fresh tokens:
- Press Win + R, type
tpm.msc, and hit Enter. - In the right-hand Actions pane, click Clear TPM…
- When prompted, click Restart. Your computer will reboot into a hardware confirmation screen (press F12 or the on-screen key to confirm clearing).
- Warning: If BitLocker disk encryption is enabled on your drive, make sure you have your 48-digit recovery key saved before clearing TPM.
2. Update Your Motherboard BIOS
Motherboard firmware bugs represent the vast majority of AMD fTPM and early Intel PTT attestation drops:
- Check your current BIOS version by typing
msinfo32in Windows Search. - Visit your motherboard manufacturer’s support portal (ASUS, MSI, Gigabyte, ASRock) and download the latest non-beta BIOS.
- For AMD systems, ensure the BIOS includes AGESA ComboV2 1.2.0.7 or later, which permanently fixes the known fTPM stutter and attestation timeout issues.
3. Verify TPM Status via PowerShell
You can verify whether Windows has fully achieved attestation readiness before running FACEIT:
Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled, ManagedAuthLevelBoth TpmPresent and TpmReady must report True. If TpmReady returns False, re-check that AMD CPU fTPM or Intel Platform Trust Technology (PTT) is enabled under Security in your BIOS.
4. Restart Cryptographic Services
If background cryptographic certificate services stall, attestation requests fail silently:
- Press Win + R, type
services.msc, and hit Enter. - Locate Cryptographic Services.
- Right-click the service, select Restart, and ensure its Startup type is set to Automatic.
5. Avoid Unofficial or “Debloated” Windows Builds
Stripped operating systems (such as Ghost Spectre, ReviOS, or AtlasOS) often strip or disable the Virtualization-Based Security (VBS) and Windows Health Attestation pipelines to conserve memory. FACEIT’s anti-cheat actively verifies these services. If you use a custom ISO, install a genuine version of Windows 10 or 11 to maintain anti-cheat compliance.
Technical Requirements & Official References
Competitive platforms enforce strict kernel validation. For detailed specifications regarding system integrity checks and platform security requirements, refer to the Official FACEIT Support Center on TPM 2.0 Guidelines.
To learn more about how Microsoft handles platform crypto provider certificates, explore the Microsoft Learn Trusted Platform Module Architecture Documentation.
