guide · static export
Security

Fix Windows Hello PIN and Fingerprint Sign-In Failures

A PIN that is rejected on every attempt, or a fingerprint reader that disappears, is usually a broken Hello container or a TPM that lost its state.

by@guidox updated:10/31/26 time:25 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11
TL;DR

Check the **TPM** state first, then reset the Hello container and set a new **PIN**. If only the fingerprint fails, reinstall its driver and switch off **enhanced sign-in security** for that reader.

Before you start

Requirements

  • A second way to sign in (password)
  • Admin rights
  • The device PIN or account password
Step by step

Instructions

01

Confirm the TPM is healthy

Hello keys live in the TPM. If the console reports it as not ready or the ownership is unclear, no PIN reset will stick.

tpm.msc
Get-Tpm
⚠ warningClearing a TPM destroys the keys on it. Do that only when nothing else works, and have your recovery options ready.
02

Reset the Hello container

The **Ngc** folder holds the Hello keys. Deleting it forces Windows to build a fresh container on the next sign-in; the old PIN stops working by design.

Stop-Service -Name CryptSvc -Force
Remove-Item "C:\indows\erviceProfiles\ocalService\ppData\ocal\icrosoft\gc\" -Recurse -Force
03

Set a new PIN

Open the sign-in options, choose PIN and go through the wizard. Windows asks for the account password once and then stores a new key in the TPM.

Settings > Accounts > Sign-in options > PIN
04

Reinstall the fingerprint driver

Remove the biometric device in Device Manager and scan for hardware changes. Windows then installs the inbox driver, which is enough for most readers.

devmgmt.msc > Biometric devices
tipVendor drivers from the laptop maker often work better than the inbox one for older readers.
05

Turn off enhanced sign-in security for a stubborn reader

Enhanced sign-in security keeps the biometric data inside a secure boundary, and some older readers fail inside it. The toggle sits under the biometric settings and needs an admin confirmation.

Settings > Accounts > Sign-in options > Enhanced sign-in security
06

Test with a fresh account

Create a temporary local account and set up a PIN there. If Hello works in the new account but not yours, the profile is damaged; if it fails in both, the problem is the device or the TPM.

Troubleshooting

Common issues

The PIN screen loops back to itself

The Hello container is half-written. Reset the Ngc folder from Safe Mode, then set the PIN again.

Windows asks for a PIN that was never set

A policy or a managed device is enforcing Hello. Sign in with the password through the alternative options link.

The fingerprint option is missing

The driver is not loaded or the device is disabled in the BIOS. Check Device Manager and the firmware setup.

It works until the laptop wakes

Fast Startup restores a stale state. Disable it in the power settings and test a full shutdown.

FAQ

Frequently asked

Is resetting the PIN dangerous?

It removes the Hello keys for that account, not the account or its files. The password still works.

Does a TPM clear wipe my disk?

No, but it removes the keys used by disk encryption. Without the recovery key an encrypted drive becomes unreadable.

How to undo this

Nothing here changes files. If you cleared the TPM, re-enable the Hello options under Settings and set a new PIN; the old keys cannot be restored.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress