Windows  ·  high  ·  Security, BitLocker & identity

Windows Hello: "Something went wrong" and the PIN is refused

The container that holds the Hello credential is unreadable or no longer matches the account, so the PIN cannot be used.

What you see

The sign-in screen offers the PIN and rejects it, or offers only "Set up my PIN" which then fails. Common after a TPM clear, a domain change or a profile restore.

What is actually wrong

The NGC container is bound to the TPM and to the account. Clearing the TPM, rejoining the domain or restoring a profile from another machine breaks that binding, and the container has to be rebuilt.

Codes and articles

0x800900110x8009002d0x801c03f2Something went wrong, your PIN isn't availableNGC

Fixes (2)

Get back in without the PIN
The sign-in screen15 minuteslow riskreversible

The PIN is the only option shown.

  1. Click "Sign-in options" below the PIN box — the password option is there but not shown by default when a PIN exists.

  2. If the account is a Microsoft account and the password is not known, reset it at account.live.com from another device first.

  3. If only the PIN is offered and the password option is absent, the machine may be configured for passwordless sign-in. Use "I forgot my PIN", which authenticates against the account online and issues a new one.

  4. On a domain machine with no network, a cached password sign-in still works — connect it to the network if the account has never signed in here before.

Confirm it workedYou reach the desktop.
If you need to undo itNot applicable.
Rebuild the Hello container
Elevated PowerShell, signed in with a password25 minutesmedium riskreversible

You can sign in another way and want the PIN working again.

  1. Try the supported route first: Settings → Accounts → Sign-in options → PIN → I forgot my PIN. This re-provisions cleanly and is enough most of the time.

  2. If that fails, take ownership of the NGC folder and clear it. Note the folder is protected, so this needs the permission change first.

    Command Prompt
    takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /r /d yicacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /grant administrators:F /t

  3. Remove the container contents.

    PowerShell
    Remove-Item 'C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\*' -Recurse -Force

    This deletes every Hello credential on the machine, for every user — not just the broken one. Everyone will have to set their PIN up again, so it is worth telling them before rather than after.

  4. Restore the default permissions on the folder afterwards.

    Command Prompt
    icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /reset /t

  5. Restart and set up the PIN again from Settings.

Confirm it workedThe PIN is accepted and survives a restart.
PowerShell
Get-Tpm | Format-List TpmReady,TpmPresent
If you need to undo itNone — the container is rebuilt from scratch. Password sign-in remains available throughout.

Related faults

0x80090016 — Windows Hello and the TPM: "Something went wrong, your PIN isn't available"Windows

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.