"Something Happened and Your PIN Isn't Available": Fix Windows Hello Sign-In

"Something happened and your PIN isn't available. Click to set up your PIN again." with error code 0x80090016 or 0x80070032 means Windows can't reach the encrypted key file that stands in for your PIN — it does not mean your PIN is wrong, forgotten, or compromised. The fix in almost every case is to sign in with your password instead, remove the broken PIN entry, and let Windows build a new one, which takes under five minutes and touches nothing else on your drive. Here's the reveal nobody puts in the first paragraph: retyping the exact same PIN that "isn't available" is the one thing guaranteed not to work, because the digits were never the problem — the hidden file behind them is.

What This Error Actually Means (and Why Retyping the PIN Never Fixes It)

A Windows Hello PIN isn't a password. It never leaves your device, and it isn't compared against anything stored online. Instead, your PIN unlocks a cryptographic key that lives in a local folder Microsoft calls the NGC store (short for "Next Generation Credentials"). When you type your PIN correctly, Windows uses it to unlock that key, and the key is what actually proves who you are. When you see "something happened and your PIN isn't available," Windows is telling you it looked for that key and either couldn't find it, couldn't open it, or wasn't allowed to touch it — before your PIN even entered the picture.

That's what the error codes are pointing at. 0x80090016 is a Windows cryptography error officially named NTE_BAD_KEYSET, which Microsoft's own troubleshooting documentation defines as "keyset does not exist" — the specific key container your PIN is supposed to unlock is missing or unreachable. 0x80070032 is a much more generic Windows code, ERROR_NOT_SUPPORTED, meaning "the request is not supported" in whatever context it appears; on the PIN screen it usually shows up when the sign-in method Windows is trying to use has been disabled by a policy or isn't valid on this device right now. Neither code is about your memory of the PIN. Both are about Windows failing to reach the file or permission it needs before your PIN can even be checked.

Ethan puts it more bluntly when Jake asks whether he should just keep clicking "try again": "You can click that button forty times and it'll fail forty times the same way, because you're retrying the part that already works. The PIN check was never the step that broke." That's the trap in almost every forum thread about this error — people re-enter the PIN, restart, re-enter it again, and conclude Windows Hello is "just broken," when the actual fix is one settings screen away.

Fixing It on Windows 11

Do these in order, cheapest and least destructive first. Most people are fixed by step 2 or 3.

Step 1: get past the lock screen without the PIN

On the sign-in screen, look for Sign-in options (a small link, sometimes a key or fingerprint icon) below the password box. Choose Password, or your face/fingerprint if either is set up, and sign in normally. If nothing but the broken PIN is offered and you're fully locked out of the sign-in screen, Microsoft's documented path into the recovery environment is through Settings itself, not a keyboard shortcut: go to Settings > System > Recovery and select Restart now under Advanced startup, then choose Troubleshoot once the device reboots into the recovery menu.

Step 2: remove and recreate the PIN

Once you're signed in, open Settings (Win + I) and follow these steps, which mirror Microsoft's official PIN change/reset instructions:

1. Go to Accounts > Sign-in options.
2. Select PIN (Windows Hello), then choose Remove. Confirm with your account password if asked.
3. Restart the PC before trying to add a new PIN. Skipping this step is the single most common reason people land back on the same error a minute later.
4. Return to Sign-in options, select PIN (Windows Hello), and choose Set up. You'll be asked for your Microsoft account password (or local password) once more before you can pick a new PIN.
5. Sign out and test the new PIN before you close anything else.

If the option to remove or add a PIN is grayed out entirely, don't fight it here — skip ahead to the TPM section or the work-PC section, because a grayed-out control almost always means a policy or hardware block, not a corrupted PIN.

Step 3: clear the stuck key container directly

If Remove/Set up loops back to the same error, the key container itself is what's damaged. This step is the least formally documented one in this guide — it's the fix reported as working across many Microsoft support-community threads rather than a single official knowledge-base article, so treat it as the "try this if Step 2 didn't hold" option rather than the first move. The container lives in a system folder, not your personal AppData:

1. Open File Explorer and turn on hidden items: View > Show > Hidden items.
2. Navigate to C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft. You're going to the LocalService profile, not your own user folder — that's the detail that trips people up when they search this manually.
3. Right-click the folder named Ngc and check Properties > Security. If you don't have permission to open or delete it, use Advanced > Change owner to take ownership as your admin account first.
4. Delete the contents of the Ngc folder (not the folder itself if Windows won't let you remove it).
5. Restart the PC, then set up the PIN again from Sign-in options.

When the Problem Is the TPM, Not the PIN

Here's a piece of jargon worth explaining before it scares anyone off: TPM stands for Trusted Platform Module, a small security chip (or a firmware equivalent on many laptops, called fTPM or PTT) that stores encryption keys separately from your hard drive, so a thief who pulls the drive still can't read what's protected by it. Your Windows Hello PIN key and your BitLocker encryption key both typically live behind the TPM. If the TPM itself is the thing that's stuck — not just the Ngc folder — deleting that folder won't help, because Windows can't recreate a key the chip won't cooperate with. This section applies the same way on Windows 11 and Windows 10, so it sits here once rather than being repeated in both OS sections.

Check this route if Step 2 and Step 3 above didn't fix anything, or if Windows Security shows a warning under Device security > Security processor. Open Settings and go to Privacy & security > Windows Security > Device security > Security processor troubleshooting. If that page reports a problem and offers a Clear TPM button, that's the one to use rather than digging into the BIOS.

Clearing the TPM the supported way

1. Press Win + R, type tpm.msc, and press Enter. This opens the TPM Management console — a Microsoft administrative tool, not a third-party utility, so there's nothing to download.
2. Under Actions, select Clear TPM. Windows will explain that this resets the chip to its factory, unowned state.
3. Confirm and restart when prompted. Microsoft's own guidance is specific here: always clear the TPM from within Windows (tpm.msc or the Windows Security app), never directly from the UEFI/BIOS menu.
4. After the restart, Windows automatically reinitializes and takes ownership of the TPM on its own — there's no owner password for you to set on a modern consumer PC.
5. Go back to Sign-in options and set up the PIN fresh.

Jake asked the obvious follow-up: "What if I clear it and I never wrote the key down?" Ethan didn't soften it: "Then you're locked out of that drive, full stop. Nobody, including Microsoft, can hand you a BitLocker key they don't have a record of. That's the whole point of the chip." It's a hard limit worth stating plainly rather than glossing over — if you don't know where your recovery key is, find it before you touch tpm.msc, not after.

Fixing It on Windows 10

The steps above are the same on Windows 10 — Settings > Accounts > Sign-in options, the same Ngc folder path, the same tpm.msc console. Where Windows 10 differs is the context you're doing this in, and it's worth being honest about that context up front.

If you'd rather stay covered while you decide what to do about the PC long-term, consumer Extended Security Updates are still open for enrollment as of this writing. Microsoft extended the program in June 2026, so devices that enroll now are covered through October 2027, not just the original one-year window. Enrollment is under Settings > Windows Update > Enroll now, and it requires being on 22H2 and signed in with a Microsoft account rather than a local one. It's free if you sync your settings through Windows Backup, costs 1,000 Microsoft Rewards points, or is a one-time roughly $30 purchase, and covers up to ten devices per account.

None of that fixes today's PIN error faster, but it's the honest bridge, and it's the one place a Windows 10 post can point you toward upgrade planning without it feeling bolted on: if this PC is eligible for Windows 11 and the PIN trouble is one of several small annoyances piling up, ESU buys you time to move on your own schedule instead of your PC's.

Domain-Joined and Work PCs: A Different Animal

Jake's shop runs two PCs joined to a Microsoft 365 Business tenant for the accounting software, and one of them threw this exact error after a policy push from his IT contractor. This is worth its own section because the fix is completely different, and none of the steps above will work here.

On a domain-joined or Microsoft Entra-joined PC, a PIN isn't a simple "convenience PIN" — it's governed by a Windows Hello for Business policy, and Microsoft's own documentation is explicit that a convenience PIN cannot be created at all when a "Turn on convenience PIN sign-in" policy and a Windows Hello for Business policy are both active without the device being properly joined to Microsoft Entra ID. In plain terms: if an administrator's policy is in an inconsistent state, no amount of removing and re-adding the PIN in Settings will fix it, because Settings isn't where the block lives.

If your PC falls in that last row, this is the section where the post has to say plainly what it can't do for you: you cannot override an Intune or Group Policy-managed Windows Hello setting from the Settings app, no matter how many times you remove and recreate the PIN. Ethan's advice to Jake was to stop touching the PC and email the contractor with the exact error code, because "every extra thing you try on a managed machine is one more thing IT has to untangle before they can tell what actually broke." That's not a cop-out — it's the honest edge of what a home-user fix can reach.

Edition Limits Worth Knowing Before You Start

A few edition differences change which of the steps above are even available to you, and they trip people up because most PIN troubleshooting guides assume Pro.

That middle row matters more than people expect: if you clear the TPM on a Home edition PC, you're relying on the auto-saved Device Encryption key in your Microsoft account rather than a key you manage yourself, so aka.ms/myrecoverykey is genuinely your only documented way to retrieve it. There's no BitLocker control panel on Home to check the key against first.

Why Resetting the PIN Doesn't Touch Your Files

This is worth stating outright because "delete a system folder" understandably makes people nervous. Removing and recreating a PIN, and clearing the contents of the Ngc folder, only affects the small credential file your sign-in uses. It's separate from your documents, photos, installed programs, and browser data, all of which live in your own user profile, not the LocalService system profile the PIN key sits in. The one thing that is genuinely at stake is BitLocker or Device Encryption, which is why the TPM section above is the one place in this guide with a real warning attached — and why it's kept separate from the ordinary PIN reset, which carries no such risk.

When Nothing Above Works

Rare, but it happens: the PIN removes cleanly, the TPM clears without error, and the exact same message comes back the moment you try to set a new one. At this point the problem usually isn't Windows Hello at all — it's the user profile or the Microsoft account link underneath it.

Convert to a local account, then convert back

This forces Windows to rebuild the account's sign-in credentials from scratch rather than repairing pieces of the old ones. It's slower than the steps above, but it's the safest documented fallback that doesn't involve a clean install.

1. Settings > Accounts > Your info > Sign in with a local account instead. You'll verify with your PIN or password one last time, then pick a name and password for the local account.
2. Restart and sign in with the new local account to confirm it works.
3. Go back to Settings > Accounts > Your info > Sign in with a Microsoft account instead, and sign back in with your Microsoft account credentials.
4. Windows will prompt you to set up a PIN as part of re-linking the account. Set it up here rather than skipping it.

If you can't sign in with anything — no password, no PIN, no biometric — that's a different, harder problem than this article covers, and no amount of Ngc-folder deletion reaches it from a locked screen. In that situation, "I forgot my PIN" only appears for Microsoft accounts, not local ones, so if you're on a local account with no working credential, you need a password reset via a recovery drive or another admin account on the same PC. There isn't a shortcut around that, and any guide claiming otherwise is selling you a false promise.

Stopping This From Happening Again

There's no setting that guarantees this never recurs — the Ngc store can get knocked loose by an interrupted update on any PC. Two habits meaningfully reduce how bad it is when it does happen. First, know your BitLocker or Device Encryption recovery key location before you need it: check aka.ms/myrecoverykey now, while you're calm, rather than mid-lockout. Second, keep a second working sign-in method active at all times — a password you actually remember, or a fingerprint/face enrollment alongside the PIN — so a broken PIN is an inconvenience you fix in Settings instead of a locked screen you fix in Safe Mode.

The Bigger Question: Can You Just Skip All This With a Local Account?

Jake's next question was the one everyone eventually asks: "Why not just never link a Microsoft account and skip the whole PIN thing?" Fair, and worth naming what half the internet still tells people that no longer works. The local-account bypasses that used to run during Windows 11 setup — the OOBE\BYPASSNRO command and the registry tricks built on it — have been removed by Microsoft on current builds, and a follow-up command, start ms-cxh:localonly, was blocked too. Both Home and Pro personal setups now require internet access and a Microsoft account during initial setup.

What still works, documented and current: creating custom install media with Rufus that includes a checkbox to skip the Microsoft account requirement, using an unattend.xml answer file if you're comfortable with that, or the safest and least fiddly route — finish setup with a Microsoft account as usual, then go to Settings > Accounts > Your info > Sign in with a local account instead afterward. Once you're local, there's no PIN tied to a Microsoft account to break, though you lose the benefits that come with one, like the automatic Device Encryption recovery key backup described earlier in this guide.

Frequently Asked Questions

What does "Something happened and your PIN isn't available" actually mean?

It means Windows failed to reach the encrypted key your PIN is supposed to unlock, before ever checking whether the digits you typed were correct. The PIN itself is almost never the problem.

What does error code 0x80090016 mean?

It's NTE_BAD_KEYSET, a Windows cryptography error meaning the specific key container your PIN needs doesn't exist or can't be found in its expected location.

What does error code 0x80070032 mean on this screen?

It's ERROR_NOT_SUPPORTED, a generic Windows code meaning the sign-in method being requested isn't valid right now, usually because a policy disabled it or the setup is inconsistent.

Will I lose my files if I remove and reset my PIN?

No. Removing a PIN only affects the small sign-in credential file in the system's Ngc folder, not your documents, apps, or personal data.

Why does my PIN keep disappearing after Windows updates?

An interrupted or incomplete update can leave the Ngc key container in a half-written state, which is what triggers this error. Recreating the PIN afterward rebuilds it cleanly.

Can I still sign in if my PIN doesn't work?

Yes, as long as you have another sign-in method set up — your account password, or facial or fingerprint recognition if enrolled. Use that to get in and fix the PIN from Settings.

Why is "I forgot my PIN" not showing on my sign-in screen?

That option is only available for Microsoft accounts, not local accounts. If you're on a local account, you have to sign in with your password first, then reset the PIN from within Settings.

Does clearing the TPM delete BitLocker's recovery key too?

Clearing the TPM removes the keys stored on the chip, including the one BitLocker or Device Encryption relies on. The recovery key itself, if you've saved it to your Microsoft account or written it down, still works to unlock the drive afterward.

My PC is Windows 11 Home — can I still use these fixes?

Yes, the PIN removal and TPM steps work identically on Home. The one difference is Group Policy Editor isn't available on Home, so any policy-level fix uses the registry key equivalent instead.

Why does my work laptop still not offer PIN sign-in after I fixed it?

On a domain-joined or Entra-joined PC, PIN sign-in is governed by an organizational policy. If that policy is misconfigured, removing and recreating the PIN in Settings will not override it, and that requires your IT administrator.

Is a PIN really more secure than a password?

Yes, in one specific way: a PIN is tied to this device only and never travels over the network, so stealing it from one PC doesn't help an attacker sign into anything else, unlike a reused password.

Can I turn off Windows Hello and just use a password?

Yes, from Sign-in options you can remove the PIN and rely on your password alone. There's no requirement to keep a PIN configured.

Why do I have to be online to fix my PIN?

Setting up a new PIN on a Microsoft account requires verifying your account password online first, which is the same reason initial Windows 11 setup on a personal PC also requires an internet connection.

What's the difference between a convenience PIN and Windows Hello for Business?

A convenience PIN is the simple, personal sign-in method on a home PC. Windows Hello for Business is the managed version used on domain- or Entra-joined machines, controlled by organizational policy rather than the Settings app.

Will a new PIN sync to my other Windows 11 devices?

No. A PIN is created and stored separately on each device, tied to that device's TPM, so setting a new PIN on one PC has no effect on any other PC signed into the same Microsoft account.

How do I stop this from happening again?

You can't guarantee it won't recur, since it's usually triggered by an interrupted update. Keeping a second working sign-in method active and knowing where your recovery key is stored turns a future occurrence into a five-minute fix instead of a lockout.

Revision note. Written August 2026, covering Windows 11 25H2 and 24H2 and Windows 10 22H2, including the current consumer ESU window running through October 2027. Look this will need a look whenever Microsoft reshuffles the Settings > Accounts layout again or changes the ESU enrollment terms, so refer latest details on MS website if not worked or let me know through contact us page, i will check and update... If you're reading this at 11pm with a laptop you can't get into, take a breath — this one almost always turns out to be smaller than it looks on the lock screen. Happy fixing, see you on next post