author avatar
27 October 2026  Jennifer Thatcher  Technology Manager of Test Dept.
Last update by James Smith at 27 October 2026

Summary
This in-depth guide walks through several technical methods for fixing the “TPM error: PIN unavailable” issue in Windows 11, from basic sign-in workarounds to advanced BIOS and NGC folder repairs. The article lays out a systematic troubleshooting path that covers TPM status checks, service configuration, and use of a secure recovery toolkit to get Windows Hello working again.



Table of contents

table iconWhen to use Renee PassNow to regain access or clear sign-in barriers
table iconStep-by-step: fix the TPM-related PIN unavailable error in Windows 11
table iconFAQ
If you see a message like “Something happened and your PIN isn’t available ” or “PIN is no longer available” on the lock screen, it means Windows Hello has lost its secure connection to the TPM security processor. To fix the “TPM error: PIN unavailable” issue in Windows 11, start by identifying the common triggers. Typical error codes are 0x80090027, 0x80090016, and 0x80280006.
Windows sign-in error saying Windows Hello PIN is no longer available
Trigger Description Representative Event / News

🔧 BIOS / Firmware Update

The TPM resets, re-initializes, or Intel PTT / AMD fTPM changes state. This makes previously enrolled Windows Hello credentials invalid.

📅 Aug 9, 2022 – Microsoft KB5012170 (Secure Boot DBX Update)

Microsoft released KB5012170 to update the UEFI Secure Boot forbidden-signature database (DBX). Many users reported that the update triggered TPM/PCR measurement changes, BitLocker recovery prompts, and Windows Hello re-validation on some devices.

🖥️ Hardware Replacement

Replacing a motherboard, swapping CPUs (on some platforms), or adding or replacing a TPM can invalidate existing Windows Hello keys.

📅 Ongoing (Windows 10/11 lifecycle)

Microsoft and major OEMs (Dell, HP, Lenovo) note that replacing the motherboard or TPM breaks the trust relationship between Windows Hello credentials and the original TPM. Users usually have to re-enroll their PIN and may need their BitLocker Recovery Key.

🛡️ Windows Security Update

Security updates can change TPM access policies, Secure Boot measurements, or Windows Hello-related components, which may lead to PIN re-enrollment.

📅 Aug 9, 2022 – Microsoft KB5012170 (Secure Boot DBX Update)

One of the most visible Microsoft security update events linked to TPM-related authentication issues, BitLocker recovery events, and Windows Hello credential revalidation.

📅 2023–2025 – Multiple cumulative update discussions in Microsoft Community & Q&A

Users reported errors such as: "Your PIN is no longer available due to a change to the security settings on this device." In most cases, re-creating the PIN or re-enrolling Windows Hello solved the problem.

🔑 Microsoft Account Password Change

After a password reset or account recovery action, local Windows Hello credentials and cloud identity state can get temporarily out of sync.

📅 2019–Present – Microsoft Account Synchronization Scenarios

After a Microsoft account password reset, MFA enrollment, security information update, or account recovery, some users found their Windows Hello PIN unavailable until they completed identity verification and set up a new PIN. This is generally treated as expected identity synchronization behavior, not a product defect.

Quickest and safest actions:
1. On the lock screen, click Sign-in options and choose Password or another available method.
Windows lock screen showing Sign-in options with password selected
2. If device encryption is on, back up your BitLocker recovery key right away at aka.ms/myrecoverykey.
3. Go to Settings > Accounts > Sign-in options, expand PIN (Windows Hello), remove your old PIN, and set up a new one.
If the password option is missing or these quick steps don’t work, use Renee PassNow or follow the step-by-step fixes.

When to use Renee PassNow to regain access or clear sign-in barriers

Renee PassNow is a bootable Windows recovery toolkit built for situations where you’re locked out of your system. It runs outside of Windows, so it can remove Windows 11 PINs and local/Microsoft account sign-in blocks even when Settings, Safe Mode, or System Restore aren’t accessible.
Fix Your Windows 11 PIN Error – Download Renee PassNow

Bypass TPM-related PIN blocks Boot from USB to clear a forgotten PIN or locked account when TPM settings block normal sign-in.

Recover the files Recover the deleted files without Windows system.

Transfer the data Transfer the important files of the computer with system.

Multifuctional Data transfer, data recovery, bootable problem recovery can be run without system.

Highly compatible Windows 11/10/8.1/8/7/XP/Vista. UEFI boot.

Remove Login Password Support Windows 11/10/8.1/8/7/XP/Vista. UEFI boot.

Recover the files Recover the deleted files without Windows system.

Transfer the data Transfer the important files of the computer with system.

Free TrialFree TrialNow 2000 people have downloaded!
Renee PassNow Create a Live USB screen with the target USB drive selected
The PassNow! function clears PINs and passwords, while Create new account lets you create a temporary local administrator. Data Transfer and Undeleter help you back up files before you make repairs.
After loading into main interface, please select the “PassNow!” function.
After loading into main interface, please select the “PassNow!” function.
Pros:
  • Clears Windows 11 PINs and local/Microsoft account login credentials without prior password hints
  • Boots from USB when Windows can’t start normally, including locked sign-in loops
  • Includes Data Transfer and Undeleter for offline backup and file recovery
  • Creates a new local administrator account on a damaged user profile

Cons:

  • Requires a second working PC to create the bootable USB drive
  • USB creation erases the target drive completely
  • Microsoft account recovery converts the account to local and requires re-linking afterward

Step-by-step: fix the TPM-related PIN unavailable error in Windows 11

Follow these steps in order, from lowest to highest risk. Stop as soon as your PIN works again.

Prerequisite: Back up the BitLocker recovery key

Before you change any TPM or BIOS settings, find your 48-digit BitLocker recovery key and save it somewhere safe.
Enter BitLocker recovery key screen
Where to check:
1. Microsoft Account: account.microsoft.com/devices/recoverykey
2. Active Directory or Azure AD (for work/school devices)
3. A saved USB flash drive, PDF export, or printed copy
You can also see How to Find and Use Your BitLocker Recovery Key for more details.
Clearing the TPM or changing BIOS settings while BitLocker is active and no recovery key is available WILL result in permanent data loss.

Step 1: Sign in with your password and recreate the PIN

On the lock screen, click Sign-in options and choose Password.
Windows lock screen showing Sign-in options with password selected
1. Go to Settings > Accounts > Sign-in options.
Windows Sign-in options page with PIN settings highlighted
2. Under PIN (Windows Hello), click Remove and confirm.
3. Re-authenticate with your account password, then click Add to set up a new PIN.
If the password option is missing, check whether Only allow Windows Hello sign-in for Microsoft accounts is turned on. Turn it off in Settings and try again. For Microsoft accounts, you may need an active internet connection to verify your identity.

Step 2: Check TPM status and services

Make sure Windows detects the TPM and that the required services are running.
1. Press Win + R, type:

tpm.msc

and press Enter.
2. Under Status, you should see “The TPM is ready for use”.
tpm.msc status
You can also open Windows Security > Device security > Security processor details to check the TPM status.
3. Press Win + R again, type:

services.msc

and press Enter. Find TPM Base Services (TBS) and make sure Startup type is Automatic and the service is Running.
If the status reads “Compatible TPM cannot be found” or you see error 0x80090016, go on to Step 3.

Step 3: Enable/reset the TPM in BIOS/UEFI

Check that the firmware-level security processor is enabled and set up correctly.
1. Restart your PC and press the firmware key (F2, Del, F10, or F12) at startup to open BIOS/UEFI.
2. Go to the security settings. The names vary by manufacturer:
- Intel platforms: Platform Trust Technology (PTT)
- AMD platforms: AMD fTPM or fTPM switch
- Discrete TPM: Security Chip or TPM 2.0 Device
BIOS Security screen showing TPM or firmware TPM setting
3. Set the status to Enabled or Available, save your changes, and exit (F10).
If the TPM is already enabled, try switching it off, saving and rebooting, then turning it back on to force Windows to re-detect the device.

Step 4: Repair/reset the Windows Hello NGC folder

Corrupted TPM credentials in the Windows Hello NGC folder can trigger the PIN unavailable error. Removing or renaming this folder forces Windows to generate new credentials.

Safe Mode method (recommended):

File Explorer showing the Ngc folder under Local AppData Microsoft
1. Hold Shift and click Restart on the lock screen.
Windows, shift + restart
Go to Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 or F4 for Safe Mode.
select startup settings in advanced options
2. Open File Explorer and go to:

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft

3. Find the Ngc folder, right-click it, and delete it or rename it to Ngc.old.
ngc folder in Windows
4. Restart Windows normally, open Settings > Accounts > Sign-in options, and set up a new PIN.

Alternate command-line method:

If access is denied, use an elevated Command Prompt.
1. Search for cmd and select Run as administrator.
Windows Start search result for Command Prompt with Run as administrator
2. Run:

takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /r /d y
icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /grant administrators:F /t
ren C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc Ngc.old

3. Reboot into normal mode and create a new PIN in Settings > Accounts > Sign-in options.

Step 5: Clear the TPM state (last resort)

Clearing the TPM resets all hardware security keys to factory defaults. Only do this if nothing else works.
- Method A (Windows Security): Go to Windows Security > Device security > Security processor details > Security processor troubleshooting > Clear TPM.
Clear TPM option selected in the tpm.msc console
- Method B (PowerShell): Open PowerShell (Admin) and run:

Clear-Tpm

- Method C (BIOS): Select Clear TPM or Reset fTPM/PTT from the BIOS/UEFI menu.
Warning: This wipes all TPM cryptographic keys, invalidates Windows Hello PINs, facial recognition, and fingerprints, and will lock BitLocker drives. Only go ahead if you have your BitLocker recovery key.

FAQ

Will clearing the TPM delete my personal files?

Answer: No. Clearing the TPM does not erase your personal files, photos, installed apps, or documents. It does, however, remove all cryptographic credentials stored in hardware—including Windows Hello data (PIN, fingerprint, facial recognition) and BitLocker encryption keys. You’ll need to set up your PIN again and enter your BitLocker recovery key after rebooting.

Will clearing the TPM trigger a BitLocker recovery key prompt?

Answer: Yes. BitLocker relies on the TPM chip to unlock your drive automatically. Clearing or resetting the TPM deletes the stored decryption key, so Windows will ask for the 48-digit BitLocker recovery key the next time you boot. Always make sure you have this key before clearing the TPM.

Why is the PIN unavailable after a BIOS or firmware update?

Answer: BIOS updates often reset firmware configuration registers to their defaults. This can change the cryptographic endorsement key or reset Platform Trust Technology (PTT/fTPM), which breaks the secure link between Windows Hello and the TPM chip.
Renee Passnow – Professional Windows Password Remover

Remove Windows Login Password 3 steps for whole password remove process.

Enable/Create Administrator One click for creating new administrator and enable the disabled account.

Widely Use New version supports UEFI boot model, which can be used on more computers, laptops and even surfaces.

Multifuctional Data transfer, data recovery, bootable problem recovery can be run without system.

Highly compatible Windows 11/10/8.1/8/7/XP/Vista.

Remove Login Password Support Windows 11/10/8.1/8/7/XP/Vista.

Enable/Create Administrator One click for creating new administrator and enable the disabled account.

Easy to use No need of any professional knowledge or password reset disk.

Free TrialFree TrialNow 2000 people have downloaded!

User Comments

Page 1

Leave a Comment


Your comment has been submitted and is awaiting moderation.