Something Happened and Your PIN Isn’t Available: How to Fix It

The full message reads Something happened and your PIN isn’t available. Click to set up your PIN again. Some PCs show Something went wrong and your PIN isn’t available with a code such as 0xc000006d, or Your PIN is no longer available due to a change to the security settings on this device. The fixes below cover all three.

Windows can’t open the protected container that holds your Windows Hello PIN. So this isn’t a Windows Hello PIN not working because you mistyped it: the keys behind it became unreadable, usually because the TPM security chip was reset, a BIOS or firmware update changed it, or the folder that stores Windows Hello data was damaged. The error by itself doesn’t delete your files or change your password, and the usual fix is to sign in another way, remove the broken PIN and create a new one.

The fastest test: on the sign-in screen, select Sign-in options and choose the password (key) icon. If your password gets you in, you’re a few minutes from a fix; if a BitLocker recovery screen appears first, you’ll need your recovery key before anything else. On a company PC, read the work PC section before deleting anything.

Why your PIN suddenly isn’t available

A Windows Hello PIN works differently from a password. It unlocks a private key that the PC’s TPM chip generated and protects, and that key only works on that one device. Anything that changes or wipes the TPM, or damages the stored key files, breaks the PIN even though you typed it correctly.

If the trouble started the same day someone cleared the TPM in Windows Security > Device security > Security processor details, you’ve found your cause.

If Windows instead says You’ve entered an incorrect PIN several times. To try again, enter A1B2C3 below, your PIN is still set up; the TPM’s anti-hammering protection is slowing down guesses.

Type A1B2C3, then enter your PIN carefully, checking that Num Lock is on if you use the number pad. Another miss disables PIN entry until you restart, and repeated misses add lockout periods that get longer each time. If you’ve truly forgotten the PIN, select I forgot my PIN instead of guessing; Steps 2 and 3 aren’t needed.

Step 1: Get signed in with your password

On the lock screen, select Sign-in options and pick the password icon. Which password you need depends on the account type:

• Microsoft account (an Outlook.com, Hotmail or similar address): use that account’s password. If you’ve forgotten it, reset it from your phone or another PC through Microsoft’s account recovery page, then sign in with the new one while the PC is online. If yours has no password (new Microsoft accounts have been passwordless by default since May 2025), skip to I forgot my PIN below.
• Local account: use the local password set when the PC was configured. If you set up security questions, a reset link appears after a wrong password.
• Work or school account: use your Microsoft 365 or network password. You may be asked for an MFA approval.

If there’s no password option at all, the account has no password or the Windows Hello-only sign-in setting covered in Step 2 is on. In that case use the I forgot my PIN Windows 11 shows below the PIN box, which verifies your Microsoft account online and lets you create a new PIN.

Safe Mode won’t get you around this: Windows Hello PIN and biometric sign-in usually aren’t available there, so you’ll need your password anyway. If neither a password nor I forgot my PIN works and there’s no other admin account on the PC, stop. That’s an account lockout, not a PIN problem, and guessing will only lengthen any lockout timers.

Step 2: Remove the broken PIN and create a new one

1. Open Settings > Accounts > Sign-in options.
2. Select PIN (Windows Hello) > Remove, and confirm with your account password.
3. Restart the PC with it connected to the internet.
4. Go back to Sign-in options > PIN (Windows Hello) > Set up.
5. Re-add face or fingerprint sign-in; both depend on the PIN and usually need setting up again.

On a company-managed PC, use PIN (Windows Hello) > I forgot my PIN instead of Remove and complete the sign-in and MFA prompts. That’s Microsoft’s documented Windows Hello for Business PIN reset route. Then skip Step 3 and go to the work PC section below.

If Remove is grayed out, scroll to Additional settings and turn off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device (on Windows 10: Require Windows Hello sign-in for Microsoft accounts), then reopen Settings. On Windows 10 the PIN entry is labeled Windows Hello PIN. You can switch the setting back on once the new PIN works.

If Setup fails or the old error returns after a restart, check two services. Press Win + R, type services.msc, and confirm Microsoft Passport and Microsoft Passport Container aren’t set to Disabled. Their normal startup type is Manual. Tuning tools and “debloat” scripts sometimes disable them.

Step 3: Reset the Windows Hello container (personal PCs only)

Read this first. Resetting the container deletes Windows Hello sign-in data, and on current Windows 11 builds it also deletes any passkeys saved on this PC (check Settings > Accounts > Passkeys). Make sure every account on the PC has a working password, and that your passkeys exist on another device or can be recreated. Don’t do this on a company-managed PC.

Option A: reset just your account

Microsoft documents this command as the way to reset an existing Windows Hello container. Sign in to the affected account with your password, open Terminal (on Windows 10, Windows PowerShell), and run:

certutil -deleteHelloContainer

Sign out, sign back in with your password, and set up the PIN again in Sign-in options.

Option B: reset the Ngc folder for every account

If Option A fails, or the PIN broke for several accounts at once, clear the folder where Windows keeps Hello keys for all users: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc. It belongs to the system, so you have to take ownership before you can empty it. Right-click Start and open Terminal (Admin) (on Windows 10, Windows PowerShell (Admin)). The last command is PowerShell, so don’t use a Command Prompt tab. Run these three commands in order:

takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /a /r /d y

icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /grant *S-1-5-32-544:F /t

Remove-Item C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\* -Recurse -Force

The first command makes the Administrators group the owner, the second grants it full control, and the third empties the folder while leaving the folder itself in place. On Windows installed in a language other than English, replace the y in the first command with that language’s letter for “yes.” The second command names the Administrators group by its built-in ID, so it works in any language.

Restart, sign in with your password, and create a new PIN. Every account on the PC will then need its own new PIN, face or fingerprint.

Work PCs: Windows Hello for Business is different

If your company manages the PC, your PIN is probably a Windows Hello for Business credential registered with Microsoft Entra ID or Active Directory. Deleting files locally won’t fix the directory side and can remove certificates that Wi-Fi or VPN rely on. To check, open Settings > Accounts > Access work or school, or run dsregcmd /status and look for AzureAdJoined : YES or DomainJoined : YES.

What the user should do

• On the lock screen, select I forgot my PIN, sign in and complete MFA. This needs internet access.
• On hybrid-joined PCs, a standard (destructive) reset also needs a connection to the office network or VPN, unless your company has set up non-destructive reset.
• If the reset page shows We can’t open that page right now, the sign-in page your company uses isn’t on the PC’s allowed list. That’s an admin setting.
• If you lost the phone you use for MFA, sort that out first; see our guide to moving Microsoft Authenticator to a new phone.

What the admin can do

• Enable non-destructive PIN reset by granting admin consent to both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production in Entra ID, then setting Enable Pin Recovery to True in an Intune Settings catalog policy (category Windows Hello For Business). Users who forget their PIN then keep their keys and certificates when they reset.
• If the user has no password to fall back on, enable Temporary Access Pass in the Authentication methods policy, then create one in the Microsoft Entra admin center (Entra ID > Users > the user > Authentication methods > Add authentication method). On an Entra-joined PC with web sign-in enabled, they can sign in with it and set up Windows Hello again; on hybrid-joined PCs they need another sign-in method first.
• Run dsregcmd /status on the affected PC. In the user state section, NgcSet shows whether a Hello credential exists and CanReset shows which reset types are available.
• Match any PIN creation error code to Microsoft’s list. For example, 0x80090029 means the TPM isn’t set up (open tpm.msc and choose Prepare the TPM), and 0x801C000E means the user hit the device registration limit.

Setting up non-destructive reset once for every user is part of routine Microsoft 365 management. It can’t bring back Hello keys wiped by a TPM reset, though; those users still sign in with their password and set up a new PIN.

When it isn’t really the PIN, and when to stop

Some PIN errors are symptoms of something bigger. Stop rebuilding the PIN and look deeper when:

• The PIN breaks again after every restart. Open tpm.msc. If it doesn’t report that the TPM is ready for use, the chip or its firmware needs attention, usually through a BIOS or TPM update from the PC maker. Before any firmware update, save your BitLocker recovery key and suspend BitLocker, because the update can trigger a recovery prompt and may reset the PIN again.
• You also see a BitLocker recovery screen. Both point at the same TPM change. Deal with BitLocker first.
• Your password also fails with a profile error. That’s a different fault; see User Profile Service failed the sign-in.
• Several work PCs break at once. Look for a recent Intune or Group Policy change, or a firmware update pushed to all of them.

If you can sign in with your password but the PIN won’t stay set up, this is a typical $59 remote fix: we connect with your permission, check the TPM, services and policies, and rebuild Windows Hello while you watch.

Common questions

Will I lose my files if my PIN isn’t available?

Not from the PIN error itself. The PIN only unlocks your sign-in; your documents, apps and settings stay where they are. The exception to watch for is a BitLocker-encrypted PC whose TPM was reset: it will ask for the recovery key, and without that key the drive can’t be unlocked. The fixes on this page remove only Windows Hello sign-in data, plus any passkeys stored on the PC if you reset the whole container.

Why do I have to set up my PIN again after a BIOS update?

The PIN unlocks a key that the TPM chip protects. Some BIOS and TPM firmware updates reset or change the TPM, so the old key can’t be opened anymore and Windows asks you to create a new PIN. It’s expected after that kind of update. Sign in with your password, remove the PIN and set up a new one.

Can I turn off the PIN and just use my password?

On a personal PC, yes. Remove the PIN in Sign-in options, after turning off the setting that only allows Windows Hello sign-in for Microsoft accounts if it’s on. Microsoft considers a PIN safer than a password because it only works on that one PC, so it’s worth setting a new one once things are stable. Face and fingerprint sign-in also need a PIN. On a work PC with Windows Hello for Business, the PIN can’t be disabled because it’s the fallback for biometrics.

Is it safe to delete the Ngc folder?

On a personal PC it’s generally low-risk as long as every account has a working password: it removes Windows Hello data, and Windows rebuilds the container as each person sets up a PIN again. On current Windows 11 builds it also removes passkeys saved on the device, so check those first. Microsoft’s documented reset is certutil -deleteHelloContainer, so try that before deleting folders. On a company PC, don’t; use I forgot my PIN or ask IT.

What if I forgot both my PIN and my password?

For a Microsoft account, select I forgot my password on the sign-in screen, or reset it at account.live.com/password/reset from your phone, then sign in with the new password while the PC is online and create a new PIN. For a local account, answer your security questions or use a password reset disk if you made one; another administrator account can also set a new password. For a work account, ask IT. Otherwise, the last resort is resetting Windows, which can remove apps and data, so get help first.

Why did my PIN stop working after a Windows update?

Often the update that broke it was firmware rather than Windows itself: many PC makers ship BIOS, UEFI and TPM firmware through Windows Update, and some of those updates reset the TPM. One documented Windows exception: after the April 2025 Windows 11 24H2 update KB5055523, some PCs that turned on Secure Launch and then ran Reset this PC lost PIN and face sign-in; KB5055627 addressed it. Either way, sign in with your password and set up the PIN again.