# Fix "PIN Is Not Available" in Windows 11

URL: https://www.mytechnician.tech/tips/fix-windows-hello-pin-not-available-windows-11/
Published: 2026-08-06 | Author: Ankit Kumar
Tags: Windows 11, Security, Troubleshooting, Fix, Password
Summary: Locked out by "Something happened and your PIN isn't available"? Sign in with your password, reset the Ngc folder, and set the PIN up again properly.

## The Problem
The sign-in screen shows **"Something happened and your PIN isn't available"** with a **Set up my PIN** button — and clicking it either fails or throws a code such as `0x80090016`, `0x8009002d`, or `0x80090011`.

Windows Hello does not store your PIN as a password. It stores a cryptographic key, protected by the TPM chip, in a system folder called **Ngc**. The PIN unlocks that key locally, which is why a PIN is more secure than a password despite looking simpler. When the Ngc container is damaged, or the TPM state changes, the key cannot be unwrapped — and Windows has no way to describe that in plain English, so you get this message instead.

> **The fix is almost always to delete the Ngc container and create the PIN again.** Your account and files are unaffected. Step 3 is the main event; the rest is getting in and cleaning up.

## Symptoms
* **"Something happened and your PIN isn't available"** at sign-in, sometimes with **"Click to set up your PIN again"**.
* Setting a new PIN fails with `0x80090016`, `0x8009002d`, or `0x80090011`.
* **Settings** → **Accounts** → **Sign-in options** shows the PIN option greyed out or erroring.
* Started after a Windows update, a BIOS update, a TPM change, or joining/leaving a domain.

## Step 1: Sign In With Your Password Instead
1. On the sign-in screen, click **Sign-in options** — the small link below the PIN box.
2. Choose the key icon for **Password** and enter your Microsoft account or local password.
3. If you cannot remember it, reset it at `account.microsoft.com` from a phone, or see [reset a forgotten Windows password](https://www.mytechnician.tech/tips/reset-forgotten-windows-password/).
4. Everything below is done from inside Windows, so getting a session is the prerequisite.

## Step 2: Try the Built-In Reset First
Sometimes the supported route is enough, and it is far less invasive than Step 3.

1. **Settings** → **Accounts** → **Sign-in options** → **PIN (Windows Hello)** → **I forgot my PIN**.
2. Verify with your Microsoft account password and set a new PIN.
3. If the option is greyed out, turn off **For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device** on the same page, then retry.
4. Restart and test. If it fails or the error returns, continue.

## Step 3: Reset the Ngc Container
This deletes the damaged Windows Hello data so Windows can build it fresh. It removes PIN, fingerprint, and face sign-in for **every** account on the PC — you will set them up again afterwards.

1. Make sure you know your account password, and if BitLocker is on, that you have your recovery key saved elsewhere: [fix the BitLocker recovery key loop](https://www.mytechnician.tech/tips/fix-bitlocker-recovery-key-loop-windows-11/).
2. In File Explorer, turn on **View** → **Show** → **Hidden items**, then browse to:
   ```
   C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc
   ```
3. Access will be denied — that is expected. Right-click the **Ngc** folder → **Properties** → **Security** → **Advanced** → **Change** beside Owner → type your username → **Check Names** → **OK**.
4. Tick **Replace owner on subcontainers and objects**, apply, then on the **Security** tab click **Edit** and give **Administrators** **Full control**.
5. Open the folder and **delete everything inside it**. Keep the `Ngc` folder itself.
6. Restart the PC.
7. Go to **Settings** → **Accounts** → **Sign-in options** → **PIN (Windows Hello)** → **Set up** and create a new PIN.
8. If ownership steps are unfamiliar, the same procedure is walked through in [fix access denied and "you need permission"](https://www.mytechnician.tech/tips/fix-access-denied-you-need-permission-windows-11/).

## Step 4: Check the TPM Is Healthy
1. **Windows + R** → `tpm.msc` → Enter.
2. **Status** should read *"The TPM is ready for use"* and **Specification Version** should be **2.0**.
3. If it reports the TPM cannot be found, it has been disabled in firmware — turn **fTPM** (AMD) or **PTT** (Intel) back on: [how to enter BIOS or UEFI](https://www.mytechnician.tech/tips/how-to-enter-bios-uefi-windows-11/) and [enable TPM and Secure Boot](https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/).
4. ⚠️ **Do not use "Clear TPM" while BitLocker is enabled.** Clearing it destroys the sealed BitLocker key, and you will need the 48-digit recovery key to boot. If you must clear it, suspend BitLocker protection first with `manage-bde -protectors -disable C: -RebootCount 2` from Terminal (Admin), and confirm the recovery key is saved somewhere off the machine.
5. After a legitimate TPM clear, redo Step 3 to rebuild the Hello container.

## Step 5: Repair the System Files
1. Right-click **Start** → **Terminal (Admin)**.
2. Run:
   ```
   sfc /scannow
   ```
3. Then:
   ```
   DISM /Online /Cleanup-Image /RestoreHealth
   ```
4. Reboot and run `sfc /scannow` once more.
5. Detail: [how to run SFC and DISM](https://www.mytechnician.tech/tips/how-to-run-sfc-dism-repair-windows-11/). If DISM fails to find source files, see [fix DISM error 0x800f081f](https://www.mytechnician.tech/tips/fix-dism-error-0x800f081f-windows-11/).

## Step 6: Clear the Policy Blocking Convenience Sign-In
Relevant on work machines, and on home PCs where someone has changed security settings.

1. **Windows + R** → `gpedit.msc` → Enter. (Not present on Windows 11 Home — use the registry route below.)
2. Go to **Computer Configuration** → **Administrative Templates** → **System** → **Logon**.
3. Set **Turn on convenience PIN sign-in** to **Enabled**.
4. On Home editions, open `regedit` and navigate to:
   ```
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
   ```
   Create a **DWORD (32-bit) Value** named `AllowDomainPINLogon` set to **1**.
5. In **Terminal (Admin)**, run `gpupdate /force`, then restart.
6. On a managed work PC, check with your IT team first — the policy may be deliberate.

## Step 7: Fix the Underlying Account Connection
Windows Hello depends on a working Microsoft account token.

1. **Settings** → **Accounts** → **Your info** — if there is a banner asking you to fix your account, resolve that before retrying the PIN.
2. Confirm the system clock is correct: **Settings** → **Time & language** → **Date & time** → **Sync now**. A wrong clock breaks the certificate exchange Hello depends on.
3. Clear stale credentials in **Control Panel** → **Credential Manager** → **Windows Credentials**, removing `MicrosoftAccount:` entries.
4. Full walkthrough: [fix Microsoft account sign-in problems](https://www.mytechnician.tech/tips/fix-microsoft-account-sign-in-problems-windows-11/).

## Step 8: Test With a New Account
1. **Settings** → **Accounts** → **Other users** → **Add account** → **I don't have this person's sign-in information** → **Add a user without a Microsoft account**.
2. Set it to **Administrator**, sign in, and try creating a PIN there.
3. If the PIN works on the new account, your original profile is damaged: [fix "signed in with a temporary profile"](https://www.mytechnician.tech/tips/fix-temporary-profile-windows-11/) and [fix "User Profile Service failed the sign-in"](https://www.mytechnician.tech/tips/fix-user-profile-service-failed-sign-in-windows-11/).
4. If it fails there too, the problem is the TPM or Windows itself — go back to Step 4, then consider a repair install: [reinstall Windows without losing data](https://www.mytechnician.tech/tips/reinstall-windows-without-losing-data/).

## What Not to Do
* **Don't clear the TPM before suspending BitLocker and confirming you have the recovery key.** This is the mistake that turns a sign-in annoyance into a machine you cannot boot.
* **Don't delete the `Ngc` folder itself** — empty its contents and leave the folder in place.
* **Don't give up on the PIN and use a password everywhere.** The PIN is device-bound and cannot be reused elsewhere if it leaks; a password can.
* **Don't disable Windows Hello policies on a work machine** without asking IT.

## Still Not Working?
If a new account cannot create a PIN either, the TPM is likely faulty or stuck. Check for a TPM firmware update from your PC manufacturer, and update the system BIOS. Failing that, an in-place repair install rebuilds the Hello components while keeping your files and apps: [reinstall Windows without losing data](https://www.mytechnician.tech/tips/reinstall-windows-without-losing-data/).

Related: [fix Windows Hello not working](https://www.mytechnician.tech/tips/fix-windows-hello-not-working/), [create strong, memorable passwords](https://www.mytechnician.tech/tips/create-strong-memorable-passwords/), and [set up two-factor authentication (2FA)](https://www.mytechnician.tech/tips/set-up-two-factor-authentication-2fa/).

---
Source: https://www.mytechnician.tech/tips/fix-windows-hello-pin-not-available-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt