Fix "PIN Is Not Available" in Windows 11

The Problem

The sign-in screen shows "Something happened and your PIN isn't available" with a Set up my PIN button — and clicking it either fails or throws a code such as 0x80090016, 0x8009002d, or 0x80090011.

Windows Hello does not store your PIN as a password. It stores a cryptographic key, protected by the TPM chip, in a system folder called Ngc. The PIN unlocks that key locally, which is why a PIN is more secure than a password despite looking simpler. When the Ngc container is damaged, or the TPM state changes, the key cannot be unwrapped — and Windows has no way to describe that in plain English, so you get this message instead.

The fix is almost always to delete the Ngc container and create the PIN again. Your account and files are unaffected. Step 3 is the main event; the rest is getting in and cleaning up.

Symptoms

• "Something happened and your PIN isn't available" at sign-in, sometimes with "Click to set up your PIN again".
• Setting a new PIN fails with 0x80090016, 0x8009002d, or 0x80090011.
• Settings → Accounts → Sign-in options shows the PIN option greyed out or erroring.
• Started after a Windows update, a BIOS update, a TPM change, or joining/leaving a domain.

Step 1: Sign In With Your Password Instead

1. On the sign-in screen, click Sign-in options — the small link below the PIN box.
2. Choose the key icon for Password and enter your Microsoft account or local password.
3. If you cannot remember it, reset it at account.microsoft.com from a phone, or see reset a forgotten Windows password.
4. Everything below is done from inside Windows, so getting a session is the prerequisite.

Step 2: Try the Built-In Reset First

Sometimes the supported route is enough, and it is far less invasive than Step 3.

1. Settings → Accounts → Sign-in options → PIN (Windows Hello) → I forgot my PIN.
2. Verify with your Microsoft account password and set a new PIN.
3. If the option is greyed out, turn off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device on the same page, then retry.
4. Restart and test. If it fails or the error returns, continue.

Step 3: Reset the Ngc Container

This deletes the damaged Windows Hello data so Windows can build it fresh. It removes PIN, fingerprint, and face sign-in for every account on the PC — you will set them up again afterwards.

1. Make sure you know your account password, and if BitLocker is on, that you have your recovery key saved elsewhere: fix the BitLocker recovery key loop.
2. In File Explorer, turn on View → Show → Hidden items, then browse to:

   C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc
   

3. Access will be denied — that is expected. Right-click the Ngc folder → Properties → Security → Advanced → Change beside Owner → type your username → Check Names → OK.
4. Tick Replace owner on subcontainers and objects, apply, then on the Security tab click Edit and give Administrators Full control.
5. Open the folder and delete everything inside it. Keep the Ngc folder itself.
6. Restart the PC.
7. Go to Settings → Accounts → Sign-in options → PIN (Windows Hello) → Set up and create a new PIN.
8. If ownership steps are unfamiliar, the same procedure is walked through in fix access denied and "you need permission".

Step 4: Check the TPM Is Healthy

1. Windows + R → tpm.msc → Enter.
2. Status should read "The TPM is ready for use" and Specification Version should be 2.0.
3. If it reports the TPM cannot be found, it has been disabled in firmware — turn fTPM (AMD) or PTT (Intel) back on: how to enter BIOS or UEFI and enable TPM and Secure Boot.
4. ⚠️ Do not use "Clear TPM" while BitLocker is enabled. Clearing it destroys the sealed BitLocker key, and you will need the 48-digit recovery key to boot. If you must clear it, suspend BitLocker protection first with manage-bde -protectors -disable C: -RebootCount 2 from Terminal (Admin), and confirm the recovery key is saved somewhere off the machine.
5. After a legitimate TPM clear, redo Step 3 to rebuild the Hello container.

Step 5: Repair the System Files

1. Right-click Start → Terminal (Admin).
2. Run:

   sfc /scannow
   

3. Then:

   DISM /Online /Cleanup-Image /RestoreHealth
   

4. Reboot and run sfc /scannow once more.
5. Detail: how to run SFC and DISM. If DISM fails to find source files, see fix DISM error 0x800f081f.

Step 6: Clear the Policy Blocking Convenience Sign-In

Relevant on work machines, and on home PCs where someone has changed security settings.

1. Windows + R → gpedit.msc → Enter. (Not present on Windows 11 Home — use the registry route below.)
2. Go to Computer Configuration → Administrative Templates → System → Logon.
3. Set Turn on convenience PIN sign-in to Enabled.
4. On Home editions, open regedit and navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
   

   Create a DWORD (32-bit) Value named AllowDomainPINLogon set to 1.
5. In Terminal (Admin), run gpupdate /force, then restart.
6. On a managed work PC, check with your IT team first — the policy may be deliberate.

Step 7: Fix the Underlying Account Connection

Windows Hello depends on a working Microsoft account token.

1. Settings → Accounts → Your info — if there is a banner asking you to fix your account, resolve that before retrying the PIN.
2. Confirm the system clock is correct: Settings → Time & language → Date & time → Sync now. A wrong clock breaks the certificate exchange Hello depends on.
3. Clear stale credentials in Control Panel → Credential Manager → Windows Credentials, removing MicrosoftAccount: entries.
4. Full walkthrough: fix Microsoft account sign-in problems.

Step 8: Test With a New Account

1. Settings → Accounts → Other users → Add account → I don't have this person's sign-in information → Add a user without a Microsoft account.
2. Set it to Administrator, sign in, and try creating a PIN there.
3. If the PIN works on the new account, your original profile is damaged: fix "signed in with a temporary profile" and fix "User Profile Service failed the sign-in".
4. If it fails there too, the problem is the TPM or Windows itself — go back to Step 4, then consider a repair install: reinstall Windows without losing data.

What Not to Do

• Don't clear the TPM before suspending BitLocker and confirming you have the recovery key. This is the mistake that turns a sign-in annoyance into a machine you cannot boot.
• Don't delete the Ngc folder itself — empty its contents and leave the folder in place.
• Don't give up on the PIN and use a password everywhere. The PIN is device-bound and cannot be reused elsewhere if it leaks; a password can.
• Don't disable Windows Hello policies on a work machine without asking IT.

Still Not Working?

If a new account cannot create a PIN either, the TPM is likely faulty or stuck. Check for a TPM firmware update from your PC manufacturer, and update the system BIOS. Failing that, an in-place repair install rebuilds the Hello components while keeping your files and apps: reinstall Windows without losing data.

Related: fix Windows Hello not working, create strong, memorable passwords, and set up two-factor authentication (2FA).