How to Fix Windows Hello PIN Error 0x80090016 and 0x80090027 in Windows 11

Windows Hello shows error “0x80090016” or “0x80090027” when you try to create or use a PIN. Users commonly report it after a BIOS or firmware TPM update, though Microsoft doesn’t document a single confirmed cause for either code. If you see the broader “Something happened and your PIN isn’t available” message instead of a code, start with our guide on how to fix “Something Happened and Your Pin Isn’t Available” error in Windows.

What Windows Hello PIN Error 0x80090016 and 0x80090027 Mean

Your Windows Hello PIN isn’t stored as text. On PCs with a Trusted Platform Module (TPM), Microsoft says Windows Hello uses the TPM to help protect the keys behind your sign-in, and your PIN unlocks their use. In community troubleshooting, the local store for those keys is usually called the Ngc (Next Generation Credential) folder; Microsoft doesn’t document its internals in detail. The TPM is a security chip, or a firmware version of one, that also helps protect BitLocker keys (Microsoft: What’s a TPM?, retrieved 2026-11-06).

Both codes generally suggest Windows can’t open or read that key material, but that’s an interpretation, not an official Windows Hello diagnosis. The internal names below are commonly cited in community troubleshooting for these codes, but Microsoft doesn’t publish an official mapping for Windows Hello specifically, so treat them as general guidance rather than a confirmed diagnosis:

Error code	Commonly cited internal name	What it means for your PIN	Commonly reported trigger
`0x80090016`	NTE_BAD_KEYSET (“Keyset does not exist”)	Windows may not be able to open the key your PIN depends on	BIOS/UEFI update or fTPM reset changed the TPM state
`0x80090027`	NTE_INVALID_PARAMETER (“The parameter is incorrect”)	Possibly bad data from a corrupted or orphaned container (unconfirmed)	Damaged NGC container, botched shutdown, or feature update

The fixes below are standard Windows Hello troubleshooting, ordered from read-only checks to the deeper NGC reset.

Quick reference

Scenario	Start with
PIN broke right after a BIOS or motherboard firmware update	Fix #1, then Fix #3
PIN keeps asking to be re-created	Fix #4 and Fix #5
Error appears when opening Sign-in options or clicking I forgot my PIN	Fix #6, then Fix #7
Cleared the Ngc folder but still can’t create a PIN	Fix #8
PIN option is greyed out on a work or Pro PC	Fix #9

Fix #1: Check TPM 2.0 Status in tpm.msc

This check changes nothing, so do it first. A firmware update can switch off, reset, or change the firmware TPM (fTPM on AMD, PTT on Intel), which can leave the keys your PIN relies on unavailable until you set the PIN up again.

Press Windows + R.
Type tpm.msc and press Enter.
Look at the Status pane. You want “The TPM is ready for use.”
Under TPM Manufacturer Information, confirm Specification Version shows 2.0.

TPM Management on Local Computer console showing Status "The TPM is ready for use" and TPM Manufacturer Information with Specification Version 2.0 highlighted

If you’d rather not use a console, open Windows Security > Device security > Security processor > Security processor details and check the Specification version line.

Windows Security Device security page with the Security processor section and Security processor details link highlighted, showing the Specification version value

If tpm.msc says “Compatible TPM cannot be found” or the TPM isn’t ready, do Fix #2 and then Fix #3. If the TPM is ready, skip to Fix #4.

Fix #2: Save Your BitLocker Recovery Key Before Touching TPM Settings

Changing TPM settings in your firmware can trigger a BitLocker recovery screen at the next boot. Without the 48-digit key, you can lock yourself out of your own drive.

On any device, go to aka.ms/myrecoverykey, Microsoft’s recovery-key page, and sign in with the Microsoft account used on the affected PC. For a work or school PC, your organization’s account portal or IT department holds the key instead.
Find the PC by its device name. If more than one key is listed, match the Key ID to the one shown on the PC’s BitLocker recovery screen or in manage-bde -protectors -get C:.
Write the recovery key down, print it, or save it to a USB flash drive you keep separate from the PC.

Microsoft account BitLocker recovery keys page listing devices with saved recovery keys, device name highlighted and the 48-digit key value redacted

If no key appears for your PC, the drive may not be encrypted, or the key may be backed up elsewhere, such as a work account or a printout. Find it before going further.

Fix #3: Turn fTPM or PTT Back On in UEFI (Only If the TPM Isn’t Ready)

Some BIOS or firmware updates restore factory defaults, which can switch off the firmware TPM, though this varies by manufacturer and board model. Re-enabling it is different from clearing it.

Do not choose Clear TPM here. Clearing can erase keys stored in the TPM, which may include the keys BitLocker uses, so treat it as a last resort.

Open Settings > System > Recovery.
Next to Advanced startup, click Restart now.
Select Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
In your firmware menus, find the TPM setting. It’s usually called fTPM, AMD fTPM, Intel PTT, or Security Device Support, often under a Security or Advanced tab.
Set it to Enabled, then save and exit.
Back in Windows, re-run tpm.msc and confirm the TPM is ready for use.

This navigation reflects current Windows 11 Settings, but the exact screens can vary by Windows build and by PC manufacturer, so your menus may look slightly different. On Windows 10, the path is Settings > Update & Security > Recovery > Advanced startup. Microsoft’s Enable TPM 2.0 on your PC page covers the firmware side in more detail.

Fix #4: Sign In With Your Password and Install Updates

Microsoft’s Windows Hello troubleshooting tips list recent security updates and system changes as reasons Windows asks you to re-create a PIN.

On the sign-in screen, click Sign-in options and choose the password (key) icon.
Sign in with your Microsoft account or local account password.
Open Settings > Windows Update and click Check for updates.
Install anything pending and restart.
Try setting up the PIN again.

Fix #5: Remove and Re-Create the PIN in Settings

If Sign-in options still opens without throwing the error, this is the lightest reset.

Open Settings > Accounts > Sign-in options.
Under Ways to sign in, click PIN (Windows Hello) to expand it.

Settings > Accounts > Sign-in options page showing the Ways to sign in list with Facial recognition (Windows Hello), Fingerprint recognition (Windows Hello), and PIN (Windows Hello), with the PIN row highlighted

Click I forgot my PIN and confirm with your account password when prompted.
Enter a new PIN twice and click OK.
If that fails, click Remove, confirm with your password, restart, then come back and click Set up.

Expanded PIN (Windows Hello) section in Sign-in options with the I forgot my PIN, Remove, and Set up buttons highlighted

Verify: lock the PC with Windows + L and sign in with the new PIN.

Fix #6: Restart the Credential Manager and CNG Key Isolation Services

Credential Manager stores sign-in credentials. CNG Key Isolation (service name KeyIso) handles cryptographic key operations outside your user processes. Restarting them may clear a stuck in-memory state without touching any files.

Microsoft doesn’t list this as an official fix for these two codes, and we can’t confirm it resolves them, but restarting these services is low-risk and reversible. If Windows won’t restart one because other components depend on it, skip it rather than forcing it.

Press Windows + R, type services.msc, and press Enter.
Scroll to Credential Manager.
Right-click it and choose Restart. If it’s stopped, choose Start instead.

Services console with the Credential Manager row selected and the right-click context menu open with Restart highlighted

Scroll up to CNG Key Isolation.
Right-click it and choose Restart, or Start if it isn’t running.

Services console with the CNG Key Isolation row selected and the right-click context menu open with Restart highlighted

Repeat Fix #5.

Fix #7: Clear the Corrupted Ngc Folder Contents

Treat this as a last resort, after Fixes #1–#6, since it involves changing ownership and permissions on a protected system folder. This is a commonly used troubleshooting step for 0x80090027 and for a 0x80090016 that survives a healthy TPM check, though Microsoft’s own troubleshooting guidance points to resetting the PIN rather than this specific folder procedure.

Before you start, create a System Restore point, or at minimum confirm you have a recent backup. Emptying the folder isn’t easily undone, and the ownership/permission changes below aren’t automatically reversed afterward, so you want a way back if something goes wrong.

Before you start:

This system-wide folder can hold Windows Hello keys for more than one account, so other accounts on the PC may lose their PIN too, and you may need to set up face or fingerprint sign-in again. Work accounts that use Windows Hello for Business also need re-provisioning, which your organization may control.
Make sure you know the password for an administrator account.
The Ngc folder holds Windows Hello keys. It doesn’t contain your BitLocker recovery key, and emptying it doesn’t clear the TPM.
Only empty the Ngc subfolder. Never delete the parent Microsoft folder.
On a managed, domain-joined, or work PC, these commands may fail or be blocked by policy. Check with IT before proceeding rather than forcing the ownership change yourself.
Prefer the reversible route where it works: rename the folder (for example, to Ngc.old) while signed in as administrator and let Windows create a fresh one, then rename it back if the fresh folder doesn’t help. Use the takeown/icacls steps below only if Windows won’t let you rename it.
The takeown and icacls commands below permanently change the folder’s ownership and permissions; they aren’t an officially documented Windows Hello fix. If the path doesn’t exist, or either command returns an error, stop rather than forcing the change — that usually means the folder lives elsewhere on your build or a policy is blocking access.

Sign in with your password.
Open File Explorer and paste C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc into the address bar. That’s the usual location on Windows 11 and 10. If File Explorer says the path doesn’t exist, stop and don’t run the commands below on a different folder.
Click Start, type cmd, and select Run as administrator, then take ownership of the folder:

takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /r /d y

Elevated Administrator Command Prompt showing the takeown command run against the Ngc folder path and SUCCESS ownership messages highlighted

On non-English Windows, /d y may need your language’s word for “yes.” If you see “The system cannot find the path specified,” stop here, check the path in File Explorer, and don’t continue with the ownership change.

Give the Administrators group full control. The *S-1-5-32-544 value is the built-in Administrators group’s fixed ID, so the command works even on non-English Windows where the group has a translated name:

icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /grant *S-1-5-32-544:F /t

Elevated Command Prompt showing the icacls command granting administrators full control on the Ngc folder and the "Successfully processed files" message highlighted

If this returns an access-denied or other error instead of “Successfully processed files,” stop and don’t continue to the deletion step. The folder’s permissions may be managed by policy on that PC.

Back in File Explorer, open C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc again.
Press Ctrl + A, then Delete. Leave the empty Ngc folder in place.
Restart the PC.
Go to Settings > Accounts > Sign-in options > PIN (Windows Hello) and click Set up.

Verify: the PIN setup finishes without an error code, and the PIN works at the lock screen.

If you need to roll back: restore from the System Restore point you created before starting. System Restore may not put the folder’s original owner and permissions back, so if anything else misbehaves afterward, ask IT or Microsoft support before changing the folder further. If you used the rename approach instead of changing permissions, delete the newly created Ngc folder and rename your original folder back into place.

Fix #8: Re-Authenticate Your Microsoft Account to Provision a New PIN

If Settings still shows the old PIN or won’t let you create one after Fix #7, re-verify your Microsoft account. Microsoft doesn’t document an account problem as the cause of these two codes, but an account that’s waiting for verification can stop PIN setup from finishing.

Open Settings > Accounts > Your info.
If you see a Verify prompt, click it and complete the sign-in.
Open Settings > Accounts > Email & accounts and fix any account flagged as needing attention.
Sign out of Windows and sign back in with your password.
Return to Settings > Accounts > Sign-in options > PIN (Windows Hello) and click Set up or I forgot my PIN.

Fix #9: Check the PIN Policy in Group Policy

A policy can block PIN sign-in on Windows 11 editions that include the Group Policy Editor, such as Pro, Enterprise, and Education; Windows 11 Home typically doesn’t include gpedit.msc. Check Settings > System > About to confirm your edition if you’re not sure.

On a work or school PC, ask IT before changing anything.

Press Windows + R, type gpedit.msc, and press Enter.
Go to Computer Configuration > Administrative Templates > System > Logon.
Open the policy named Turn on convenience PIN sign-in (naming can vary slightly by build). If it’s set to Disabled, change it to Not Configured or Enabled, then click OK.
Restart and try Fix #5 again.

This policy only covers convenience PIN sign-in. On a managed PC that uses Windows Hello for Business it may not apply, and changing it can conflict with your organization’s security policy, so it’s mainly worth checking on a personal Pro PC where someone may have disabled it.

Local Group Policy Editor open to Computer Configuration > Administrative Templates > System > Logon with the Turn on convenience PIN sign-in policy highlighted in the right pane

Policy names can vary between builds. If you don’t see this setting, check Windows Components > Windows Hello for Business for any setting that’s explicitly disabled.

Common Mistakes That Make This Worse

Clearing the TPM as a “quick fix.” It can wipe keys the TPM holds and may trigger BitLocker recovery. Re-enable fTPM/PTT instead (Fix #3).
Deleting the whole ...\AppData\Local\Microsoft folder. Only the contents of Ngc need to go.
Removing the PIN without knowing your password. Confirm you can sign in with your password first, since some recovery prompts need it.
Running takeown in a normal Command Prompt. It fails with “Access is denied.” The window title must say Administrator.

Getting Help

Our guide on how to get help in Windows covers every support option. For this error specifically:

Reference pages: Microsoft’s Configure Windows Hello and common issues and troubleshooting tips pages.
Contact support: Use the Get help with Windows safety page.
Info to have ready: your Windows edition and version from Settings > System > About, the TPM status and Specification Version from tpm.msc, the exact error code, and whether the error started after a BIOS update.

Prevention Tips

Save the BitLocker recovery key before every BIOS update. It takes a minute and can save you from being locked out if the update triggers a recovery prompt.
Suspend BitLocker before flashing firmware, following your device or motherboard maker’s update guidance. Use Control Panel > BitLocker Drive Encryption > Suspend protection first; this can reduce the chance of an unexpected recovery prompt, though a firmware change can still trigger one depending on what it touches.
Confirm BitLocker actually resumed after the update. A Control Panel suspension normally ends after the next restart, but an interrupted update or a different suspension method can leave it suspended, so check Control Panel afterward and re-enable it if needed. Suspended protection is less secure, so don’t leave it off longer than necessary.
Re-check firmware TPM settings after a BIOS update. Confirm fTPM or PTT is still enabled before you boot back into Windows.
Avoid hard power-offs. A UPS on a desktop protects against the botched shutdowns that can corrupt the key container.
Add a second Windows Hello method. A Windows Hello-compatible webcam or a USB fingerprint reader gives you another quick way in, but it relies on the same Windows Hello setup, so keep your password handy too.

Is it safe to delete the Ngc folder contents?

It’s a commonly used troubleshooting step, but it isn’t officially documented, and the takeown/icacls path permanently changes the folder’s ownership and permissions. Create a restore point first, confirm your account password, and treat it as a last resort after the earlier fixes rather than a routine first step.

You’ll lose saved Windows Hello PINs and may need to re-enroll face or fingerprint, but your files and BitLocker recovery key aren’t stored there.

Why did my PIN stop working right after a BIOS update?

A common explanation is that the update reset, changed, or turned off the firmware TPM, so keys protected under the old TPM state became unavailable and Windows reports “keyset does not exist” (0x80090016). A corrupted credential container, account provisioning, or a policy change can produce the same symptom, so work through the fixes in order.

What if clearing the Ngc folder doesn’t fix it?

Run Fix #8 and Fix #9. On a work, school, or domain-joined PC, or one that uses Windows Hello for Business, contact your IT department before going further. On a personal PC, if the error still appears, the last resort is Settings > System > Recovery > Reset this PC with Keep my files.

Back up your files and confirm you have your BitLocker recovery key first, and choose Cloud download or Local reinstall. The reset reinstalls Windows and removes your apps, and you’ll likely need to set up Windows Hello again afterward. It can’t fix a TPM that’s disabled or failing in firmware.

Wrapping Up

After a BIOS update, Fix #1 plus re-enabling fTPM/PTT (Fix #3) is the first thing to check. If the PIN reset in Fixes #4 to #6 doesn’t help, emptying the Ngc folder (Fix #7) is a commonly reported community fix, but treat it as a last-resort step since it changes folder ownership and permissions. If the TPM keeps dropping to “not ready” between restarts, suspect failing firmware or motherboard hardware. If the PIN keeps breaking on a healthy TPM, run a full Microsoft Defender scan before resetting the PC.

Step	Action	Applies To
1	Check TPM status in tpm.msc	Windows 11 / 10
2–3	Save BitLocker key, re-enable fTPM/PTT	PCs with a TPM not ready after a BIOS update
4–6	Password sign-in, updates, re-create PIN, restart services	Windows 11 / 10
7–8	Empty Ngc folder (last resort), re-authenticate account	Windows 11 / 10 (admin required)
9	Check PIN policy in gpedit.msc	Windows 11 / 10 Pro, Enterprise, Education

Last updated: November 6, 2026 | Applies to Windows Hello on Windows 11 and Windows 10

Sources

Configure Windows Hello