Overview
A Windows user may be unable to sign in with their PIN and see the message: “Something happened and your PIN isn’t available. Click to set up your PIN again.”
Clicking Set up my PIN may do nothing at all, or Windows may report “Hello key creation failed” with error code 0x80090011.
Likely cause
This usually means the Windows Hello cryptographic key or PIN container is damaged or unavailable. Common causes include a corrupted Windows Hello NGC folder, damaged TPM-held keys, incomplete Windows updates, or damaged Windows system components.
Removing and re-adding the Windows account often does not fix it, because the problem is usually with Windows Hello itself rather than the user account.
Before you begin
- If the user can select Sign-in options and log in with the account password, use that method temporarily so they aren't locked out while you work.
Do not clear the TPM until BitLocker status has been checked and any required recovery key has been verified.
Clearing the TPM on a BitLocker-protected machine without the recovery key can make the drive permanently unrecoverable.
Step-by-step
Step 1 — Confirm TPM status
Press Windows + R and enter:
tpm.mscThe expected status is “The TPM is ready for use.” Also confirm that Trusted Platform Module 2.0 appears under Device Manager > Security devices without a warning icon.
Step 2 — Check BitLocker before changing TPM settings
Open Command Prompt as Administrator and run:
manage-bde -statusIf the Windows volume shows Fully Decrypted, Encryption Method: None and Protection Off, BitLocker is not active.
If BitLocker is active, obtain and verify the recovery key before continuing.
Do not clear the TPM without it.
Step 3 — Check device registration
dsregcmd /statusFor a standalone local or Microsoft-account PC, IsDeviceJoined: NO, IsUserAzureAD: NO and PreReqResult: WillNotProvision can be normal. “WillNotProvision” by itself does not prove there is a fault on a non-Entra-joined computer.
Step 4 — Delete the current Windows Hello key container
From an elevated Command Prompt run:
certutil -deleteHelloContainerRestart the computer, then try Settings > Accounts > Sign-in options > PIN (Windows Hello) > Set up.
Step 5 — Rebuild the NGC folder if needed
These commands take ownership of and permanently delete a protected Windows system folder.
Run them one at a time from an elevated Command Prompt, and only if Step 4 did not resolve the issue.
takeown /f "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC" /r /d yicacls "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC" /grant administrators:F /trd /s /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC"Restart Windows and create a new PIN.
Step 6 — Repair Windows components
DISM /Online /Cleanup-Image /RestoreHealthAfter DISM completes, run:
sfc /scannowRestart and test PIN setup again.
Step 7 — Clear the TPM only as a last resort
Clearing the TPM removes TPM-protected keys.
Confirm BitLocker is off, or that the recovery key is available and verified, before proceeding.
Path:
Windows Security > Device security > Security processor details > Security processor troubleshooting > Clear TPM
Restart and recreate the PIN.
Event Viewer verification
Open Event Viewer and browse to:
Applications and Services Logs > Microsoft > Windows > HelloForBusiness > OperationalLook for “Hello key creation failed” and error 0x80090011.
Expected result
The user can open the PIN setup wizard, create a new Windows Hello PIN, and sign in normally.
CYBER904 quick resolution order
- Use the password to gain access if available.
- Verify TPM status.
- Verify BitLocker status.
- Run
certutil -deleteHelloContainerand restart. - Rebuild the NGC folder if necessary.
- Run DISM and SFC.
- Clear TPM only after confirming recovery-key safety.
Troubleshooting
Still stuck?
Windows Hello and TPM repairs can get security-sensitive fast. If you'd rather not run the advanced steps yourself, contact CYBER904 and we'll handle it — including verifying BitLocker recovery keys before anything is cleared.