Quick answer: Sign in with your account password, then go to Settings > Accounts > Sign-in options, remove and re-create the PIN, and re-enrol your fingerprint. If the PIN still fails, reset the Ngc folder that stores Windows Hello keys. For "currently unavailable" fingerprint errors, reinstall the biometric driver and check Enhanced Sign-in Security and the TPM.
Written by the Softkeyworld technical team · Updated October 2026
Windows Hello is meant to make signing in effortless, so it's especially frustrating when the PIN box rejects a code you know is right, or the fingerprint option suddenly says "This option is currently unavailable". The causes are almost always one of a small set: a corrupted credential store, a biometric driver that an update replaced, a Trusted Platform Module (TPM) problem, or a security policy that blocks your sensor.
The steps below are ordered from least to most invasive. They apply to Windows 11 Home, Pro and Enterprise on versions 23H2, 24H2 and 25H2, and most also work on Windows 10.
Key takeaways
- Know your account password before you start. Every Hello reset falls back on it.
- A Windows Hello PIN is tied to the device and its TPM, not to your Microsoft account password.
- Fingerprint failures after an update are usually driver problems; reinstall the manufacturer's driver.
- Never clear the TPM until you've saved your BitLocker recovery key.
Match your symptom to the fix
| Message or symptom | Most likely cause | Go to |
|---|---|---|
| "Something happened and your PIN isn't available" | Corrupted Ngc credential store or TPM issue | Fix 2 and Fix 3 |
| PIN is rejected although it's correct | Keyboard layout, Num Lock, or a changed PIN on another device | Fix 1 |
| Fingerprint: "This option is currently unavailable" | Driver, Biometric service, or Enhanced Sign-in Security | Fix 4 to Fix 6 |
| "We couldn't find a fingerprint scanner compatible with Windows Hello" | Sensor missing from Device Manager or driver not installed | Fix 4 |
| PIN "Remove" button greyed out | Hello-only sign-in setting or organisation policy | Fix 7 |
| Hello stopped after a motherboard or TPM change | Keys bound to the old TPM | Fix 3 and Fix 8 |
Fix 1: Rule out the simple causes
Before touching system folders, check the basics that account for a surprising number of "wrong PIN" reports:
- Num Lock and keyboard layout. On laptops without a number pad, digits may be typed differently on non-UK layouts. Click the language indicator on the sign-in screen and confirm it's ENG UK (or whatever you used when creating the PIN).
- Letters and symbols. If you ticked "Include letters and symbols" when creating the PIN, it is case-sensitive.
- Different PIN per device. Each PC has its own PIN. Changing it on your laptop doesn't change it on your desktop.
- A full restart. Choose Restart rather than Shut down. With Fast Startup enabled, Shut down preserves the kernel session, so a stuck biometric service may not reload.
- Clean the sensor. Dirty or damp fingers and a greasy sensor cause repeated "Couldn't recognise you" messages that look like a fault.
If you're locked out completely, click Sign-in options below the PIN box and choose the key icon to use your password, or choose I forgot my PIN. For a Microsoft account you'll verify your identity by email or authenticator and then set a new PIN.
Fix 2: Remove and recreate the PIN and fingerprint
Once you're signed in with your password, rebuild your Hello credentials from scratch:
- Open Settings > Accounts > Sign-in options.
- Expand Fingerprint recognition (Windows Hello) and select Remove. Do the same for Facial recognition if present.
- Expand PIN (Windows Hello), select Remove and confirm with your password.
- Restart the PC.
- Return to Sign-in options, select PIN > Set up, then set up fingerprint. Windows requires a PIN before it allows biometrics.
When enrolling a fingerprint, use Add a finger afterwards to register the same finger a second time at a slightly different angle. Microsoft's guide to configuring Windows Hello covers the enrolment screens if you haven't used them before.
Fix 3: Reset the Ngc folder ("your PIN isn't available")
Windows stores Hello key material in a protected folder called Ngc (short for Next Generation Credentials). If it becomes corrupted, typically after an interrupted update or a disk error, you'll see "Something happened and your PIN isn't available", and setting up a new PIN may fail with error codes such as 0x80090016. Emptying the folder forces Windows to build a fresh store.
Important: this deletes Windows Hello PINs, fingerprints and face data for every user on the PC. Everyone will need their password to sign in afterwards. On a work-managed device, talk to your IT team first, because Windows Hello for Business keys are also stored here.
- Sign in with your password using an administrator account.
- Right-click Start and open Terminal (Admin).
- Take ownership of the folder:
takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /r /d y - Grant administrators access:
icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /grant administrators:F /t - Open that path in File Explorer and delete everything inside the Ngc folder (not the folder itself).
- Restart, then go to Settings > Accounts > Sign-in options and set up a new PIN.
If you can't sign in at all, hold Shift while selecting Restart on the sign-in screen, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Safe Mode lets you sign in with your password even when the PIN provider is broken.
Fix 4: Reinstall the fingerprint reader driver
When fingerprint sign-in disappears after a feature update or a driver push through Windows Update, the driver is the usual suspect. We see this frequently on laptops where Windows Update installs a generic driver over the manufacturer's tuned version.
- Right-click Start and open Device Manager.
- Expand Biometric devices. If it's missing, select View > Show hidden devices and check for warning icons under Other devices or Universal Serial Bus devices.
- Right-click the sensor (for example a Goodix, Synaptics, ELAN or Validity device) and choose Properties > Driver. If Roll Back Driver is available and the problem began after an update, use it.
- Otherwise choose Uninstall device, tick Attempt to remove the driver for this device, and restart.
- Install the fingerprint driver from your laptop manufacturer's support page for your exact model, then re-enrol your finger.
While you're in the device's Properties, open the Power Management tab if it exists and untick Allow the computer to turn off this device to save power. Some sensors fail to wake reliably after sleep with this enabled.
Fix 5: Check the Windows Biometric Service
Windows Hello biometrics depend on the Windows Biometric Service (service name WbioSrvc). Press Windows + R, run services.msc, open the service and make sure Startup type is Automatic and the status is Running. If it's running but Hello still fails, select Restart. "Optimiser" utilities and debloat scripts sometimes disable it.
If the service is stopped and won't start, run sfc /scannow followed by DISM /Online /Cleanup-Image /RestoreHealth in an admin terminal to repair system files, then restart. If a pending or failed update is part of the picture, our guide to fixing a stuck Windows 11 update covers resetting the update components.
Fix 6: External readers and Enhanced Sign-in Security
Many newer Windows 11 laptops ship with Enhanced Sign-in Security (ESS), which isolates biometric matching using virtualisation-based security and the TPM. According to Microsoft's ESS documentation, when ESS is on, only ESS-capable sensors work, and external USB fingerprint readers or cameras are blocked. That's why a USB reader can show "currently unavailable" on a laptop with ESS.
- Windows 11 24H2 and later: Settings > Accounts > Sign-in options > Additional settings > Enhanced sign-in security.
- Windows 11 23H2: the toggle is labelled Sign in with an external camera or fingerprint reader; turning it on disables ESS.
Turning ESS off reduces biometric isolation, so do it only if you genuinely need an external reader. Expect to re-enrol your biometrics afterwards. For face sign-in, remember that Windows Hello requires an infrared (IR) camera; a standard webcam won't work no matter what settings you change.
Fix 7: "Remove" is greyed out or settings are managed
If you can't remove the PIN, check Settings > Accounts > Sign-in options > Additional settings for For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device. When it's on, Windows hides password sign-in and won't let you remove the PIN. Turn it off, sign out and back in, and the Remove button becomes available.
A red "Some of these settings are managed by your organisation" message means Group Policy or Intune is controlling Hello. On Pro and Enterprise you can inspect local policy under Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business in gpedit.msc. Home doesn't include the Group Policy editor, one of the management differences we explain in Windows 11 Home vs Pro. On a company device, don't override policy; raise a ticket with IT.
Fix 8: Check the TPM (carefully)
Windows Hello protects PIN keys with the TPM where one is present. Run tpm.msc and confirm the status reads "The TPM is ready for use". If it says no compatible TPM can be found, the firmware TPM (Intel PTT or AMD fTPM) may have been disabled by a BIOS update or reset; our guide on enabling TPM 2.0 in the BIOS shows where to switch it back on.
The TPM management console also offers Clear TPM. Treat this as a last resort: it wipes every key the TPM holds, so BitLocker will ask for its 48-digit recovery key on the next boot. Make sure you have it first; we explain how to find your BitLocker recovery key in a separate guide.
After a motherboard replacement you'll be dealing with a new TPM, so Hello must be set up again from scratch, and Windows itself may also need reactivating. See Windows activation after a hardware change for that side of the repair.
If nothing works
Create a new local administrator account (Settings > Accounts > Other users > Add account) and try setting up a PIN there. If Hello works in the new profile, the problem is limited to your user profile and migrating your files is quicker than chasing it further. If it fails in every profile, a repair reinstall via Settings > System > Recovery > Fix problems using Windows Update keeps your apps and files while replacing system components.
Frequently asked questions
Why does Windows say my PIN isn't available?
The Windows Hello credential store (the Ngc folder) or its TPM-protected keys can't be read. Sign in with your password, remove the PIN and, if needed, empty the Ngc folder before creating a new PIN.
Is my Windows Hello PIN the same as my Microsoft account password?
No. The PIN is local to one device and unlocks keys stored on it. Your Microsoft account password works everywhere and is what you use to reset the PIN.
Why did my fingerprint reader stop working after an update?
Usually because the update installed a different biometric driver. Roll back the driver in Device Manager or install the one from your laptop manufacturer, then re-enrol your finger.
Can I use a USB fingerprint reader with Windows Hello?
Yes, if it's Windows Hello certified and your PC doesn't have Enhanced Sign-in Security turned on. With ESS enabled, external biometric devices are blocked.
Does Windows 11 Home support Windows Hello?
Yes. PIN, fingerprint and face sign-in work on Home and Pro. Pro adds business management features such as Group Policy and domain or Entra ID join.
Will resetting Windows Hello affect my files or activation?
No. Removing PINs, biometrics or the Ngc contents doesn't touch documents or Windows activation. Only clearing the TPM has wider effects, mainly on BitLocker.
Our recommendation
Start with a password sign-in and a clean re-enrolment, move on to the driver and the Ngc reset, and leave the TPM until last. On a business PC where you want Group Policy control over sign-in, BitLocker and remote management, Windows 11 Pro is the edition to standardise on, and a genuine Windows 11 Pro licence key upgrades an existing installation without reinstalling.
Related reading
| Resource | Why read it |
|---|---|
| Find your BitLocker recovery key | Essential before any TPM change |
| Enable TPM 2.0 in the BIOS | Fix a missing or disabled TPM that breaks Windows Hello |
| Windows 11 Home vs Pro | See which sign-in and management features each edition offers |