Windows · medium · Windows Update & servicing

0x80090016 — Windows Hello and the TPM: "Something went wrong, your PIN isn't available"

The key protecting the PIN is gone from the TPM or unreadable, so Hello cannot unlock and offers to set the PIN up again.

What you see

Sign-in offers "Set up my PIN" every restart, or fails with 0x80090016. Often after a TPM firmware update, a motherboard change, or clearing the TPM.

What is actually wrong

The Ngc container that holds the Hello credentials no longer matches the TPM, or the folder's permissions are wrong. Both look identical to the user.

Codes and articles

0x800900160x8009002dNTE_BAD_KEYSETPIN isn't available0x801c03f2

Fixes (2)

Rebuild the Ngc credential container

Elevated PowerShell20 minutesmedium risknot reversible

The usual fix. Everyone on the machine will have to set their PIN up again, so make sure a password sign-in works first.

Confirm you can sign in with the account password, not just the PIN. If you cannot, stop — this procedure removes the PIN.
Deleting Ngc with no working password leaves nobody able to sign in to the machine.

Check the TPM is present and ready.

PowerShell

Get-Tpm | Format-List TpmPresent, TpmReady, TpmEnabled, TpmOwned

Take ownership of the credential folder.

Command Prompt

takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /r /d yicacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /grant administrators:F /t

Empty it, leaving the folder itself in place.

PowerShell

Remove-Item 'C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\*' -Recurse -Force

Restore the default permissions on the folder — leaving administrators granted is not the shipped state.
Command Prompt
```
icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /reset /t /c
```
Restart and set the PIN up again from Settings → Accounts → Sign-in options.

Confirm it workedThe PIN is accepted after a restart and does not prompt to be set up again.

If you need to undo itNone — the old credentials are deleted. The account password is unaffected.

Clear and re-provision the TPM

Windows and firmware45 minuteshigh risknot reversible

The container rebuild did not help, or Get-Tpm reports the TPM is not ready. Clearing the TPM destroys every key it holds.

Check whether BitLocker is on. If it is, suspend it or save the recovery key somewhere off the machine before going further.
PowerShell
```
Get-BitLockerVolume | Format-Table MountPoint, VolumeStatus, ProtectionStatus -AutoSize
```
Clearing the TPM destroys the BitLocker key protector. Without the recovery key the drive is unrecoverable — this is the single most expensive mistake in this whole procedure.

Save the recovery key.

PowerShell

(Get-BitLockerVolume -MountPoint C:).KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword' | Format-List KeyProtectorId, RecoveryPassword

Suspend BitLocker for one restart.
PowerShell
```
Suspend-BitLocker -MountPoint C: -RebootCount 2
```
Clear the TPM.
PowerShell
```
Clear-Tpm
```
Accept the firmware prompt during the restart — it will not clear without a physical confirmation.
Set the PIN up again and resume BitLocker.
PowerShell
```
Resume-BitLocker -MountPoint C:
```

Confirm it workedGet-Tpm reports ready and owned, and the PIN survives a restart.

PowerShell

Get-Tpm | Format-List TpmReady, TpmOwned

If you need to undo itNone — TPM keys cannot be restored. BitLocker is recovered with the key saved in step 2.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.