Windows 11 PIN not working — entering the correct PIN and getting “Something went wrong” or “Incorrect PIN” even though you know it’s right — is a more specific problem than it appears. The PIN is stored locally and verified by a Windows component called Windows Hello, separate from your Microsoft account password. When that local store gets corrupted, the PIN fails even with correct input. We go deeper on the whole subject in our Complete Guide to Fixing Windows, Browser, and Software Errors.
Immediate workaround while you fix it: on the sign-in screen, click “Sign-in options” below the PIN field → select the key icon (password) → enter your Microsoft account or local account password instead. This gets you in while you resolve the PIN issue.
The most common fix: remove and re-add the PIN
This resolves the majority of PIN failures. The existing PIN entry in Windows Hello gets corrupted; removing it and creating a fresh one rebuilds the local credential store cleanly.
- Sign in using your password (see workaround above)
- Settings → Accounts → Sign-in options → PIN (Windows Hello) → I forgot my PIN
- Follow the prompts — you’ll verify identity with your Microsoft account password or an OTP sent to your email/phone
- Set a new PIN
- Sign out and test signing in with the new PIN
Even if you want to keep the same PIN number: go through the removal and re-creation process. The number can be the same — what matters is rebuilding the underlying credential file.
If “I forgot my PIN” doesn’t appear or fails
Settings → Accounts → Sign-in options → PIN → Remove → enter your account password to confirm. After removing: restart → sign in with your password → Settings → Sign-in options → Add a PIN. This is the manual version of the same process when the “forgot” flow doesn’t work.
The NGC folder fix — for persistent failures
Windows Hello stores PIN credentials in a hidden folder called NGC. When the NGC folder is corrupted or has permission issues, PIN authentication fails and even removing/re-adding through Settings doesn’t fully fix it because Settings is using the same corrupted store.
The fix is to delete the NGC folder and let Windows rebuild it from scratch:
- Open File Explorer → navigate to
C:WindowsServiceProfilesLocalServiceAppDataLocalMicrosoft - Find the Ngc folder → right-click → Properties → Security tab → Advanced → change the Owner to your user account or “Administrators”
- After taking ownership: delete the Ngc folder entirely
- Restart Windows
- Settings → Sign-in options → Add a PIN → create a new PIN
Windows recreates the Ngc folder when you set up a new PIN, with a clean structure that doesn’t have the corruption from the old one.
Domain-joined machines: different PIN storage
On Active Directory or Azure AD joined machines, PIN authentication works differently. The PIN is tied to the specific device and the user account — and Azure AD PIN verification requires connectivity to Azure AD services for some operations.
If the PIN fails on a domain machine after being offline (travelling, VPN disconnected): the device may need to connect to Azure AD to validate the credential once. Connect to the corporate network or VPN → try the PIN again → it often works after re-establishing the domain connection.
TPM issues
Windows Hello PIN is secured by the Trusted Platform Module (TPM) chip in the machine. When the TPM has issues — after a BIOS update that changed TPM state, after a Windows feature update, or after TPM was cleared — PIN authentication fails because the keys stored in the TPM are no longer accessible.
Check TPM status: Win+R → tpm.msc. The TPM management console shows whether the TPM is ready and what version it is. If it shows “Compatible TPM cannot be found” or a status error: that’s the cause. Resolving TPM issues often requires:
- Re-enabling TPM in BIOS if it was accidentally disabled
- Clearing the TPM (BIOS → TPM → Clear TPM) — this removes all TPM-stored keys and requires reconfiguring Windows Hello from scratch afterward
- A BIOS update if the TPM issue was introduced by a firmware bug
PIN stops working after Windows Update
Windows feature updates occasionally reset or invalidate stored Windows Hello credentials. This usually manifests as PIN failure immediately after the first reboot following an update. The fix is simple: sign in with your Microsoft account password → Settings → Sign-in options → remove and re-add the PIN. The update didn’t delete the PIN information permanently — it made the stored credential temporarily invalid in a way that re-creating it resolves.
Four-digit vs six-digit PIN requirements
If your organisation uses Windows Hello for Business with Azure AD, Group Policy may enforce a minimum PIN length, complexity requirements, or PIN history. If you’re trying to set a PIN but it’s rejected as “doesn’t meet requirements”: check with IT what the PIN policy is. Common enterprise requirements: minimum 6 digits, or alphanumeric PIN required. The error message during PIN creation sometimes indicates the specific requirement that wasn’t met.
Our guide on Windows 11 startup and login issues covers the broader sign-in failure scenarios including corrupted user profiles. For the TPM-related BitLocker issues that can accompany Windows Hello PIN failures, our system integrity guide covers the BIOS and TPM diagnostics. Microsoft’s Windows Hello documentation covers the PIN vs password security model, the biometric option configuration, and the specific error codes that appear when Windows Hello fails on managed devices.
PIN vs Windows Hello biometrics — different failures
Face recognition and fingerprint login are part of Windows Hello but use different authentication paths than the PIN. A failed PIN doesn’t mean face or fingerprint login also fails, and vice versa. If the PIN fails but fingerprint still works: use fingerprint to sign in and fix the PIN from Settings. If all Windows Hello methods fail simultaneously: the Windows Hello credential store has a deeper problem (likely the NGC folder issue described above).
Specific error messages and what they mean
| Error message | Cause | Fix |
| “Something went wrong. Try again.” | Generic Windows Hello failure | Remove and re-add PIN |
| “Your PIN is incorrect” (when it isn’t) | NGC folder corruption | Delete NGC folder, re-add PIN |
| “This sign-in option is disabled” | Group Policy or Intune restriction | Contact IT |
| “PIN required — Windows Hello for Business” | Domain machine needs PIN set | Set up PIN as required |
| “There’s a problem with Windows Hello” | TPM issue or Windows Update side-effect | Check TPM status; delete NGC folder |
| “We need to verify your identity” | PIN expired or account password changed | Verify with email/phone OTP, then reset PIN |
Preventing PIN failures after updates
The most reliable way to avoid post-update PIN failures: always make sure your account password is memorised and working before a major Windows update. Since the PIN removal process requires account password verification, not having the password available makes it significantly harder to recover a broken PIN. For Microsoft accounts: confirm you can sign in at account.microsoft.com with your password. For local accounts: make sure you know the password and it works.
Multiple accounts and PIN confusion
Windows 11 supports multiple user accounts, each with their own PIN. On shared machines, the wrong user account may be selected at the sign-in screen. The sign-in screen shows the account name — confirm it shows your account before concluding the PIN is wrong. If another account is displayed: click “Other user” or the account name to switch to yours.
Also relevant for Microsoft accounts: if your Microsoft account email changed but Windows still has the old email associated with the local profile, PIN verification fails when it tries to validate against the new Microsoft account. Settings → Accounts → Your info → check that the displayed email matches your current Microsoft account.
Emergency access: Reset this PC
If the PIN fails, the password isn’t available or also fails, and no other sign-in method works: “Reset this PC” is accessible from the Windows Recovery Environment (boot the machine → hold Shift while clicking Restart → Troubleshoot → Reset this PC). This preserves your files (choose “Keep my files”) but resets all Windows settings including all Windows Hello credentials — allowing you to set up a fresh PIN after reset.
This is a last resort but good to know exists. Before using it: try the NGC folder fix and the password sign-in option as they’re non-destructive.
SFC for Windows Hello infrastructure
Administrator Command Prompt:
sfc /scannowIf Windows Hello infrastructure files are corrupted by a failed update or disk error, SFC repairs them. After running SFC and restarting: try re-adding the PIN through Settings. System file corruption is a less common cause of PIN failure but is worth checking when the NGC deletion approach doesn’t fully resolve the issue.
PIN on new device or after factory reset
On a new Windows 11 machine or after a factory reset: the PIN setup during Windows OOBE (Out of Box Experience) sometimes fails for accounts that require Microsoft account verification but the machine doesn’t yet have stable internet. The PIN is then not set up, and Windows requires a PIN to sign in but has no PIN stored. Solution: connect to a stable internet connection → Settings → Sign-in options → PIN → Add → complete the verification with your Microsoft account.
If internet isn’t available: set up a local account first (which uses password, not requiring PIN), complete the setup, then set up the PIN once internet connectivity is established.
The NGC folder approach remains the most powerful fix for persistent PIN failures on Windows 11 — it forces a complete rebuild of the credential store that Settings-level removals don’t always achieve. If you’ve tried the Settings approach twice and it still fails: the NGC folder deletion is the reliable next step.
PIN synchronisation across devices
Unlike passwords, PINs are device-specific and never synchronise. The PIN set on your desktop is completely separate from the PIN on your laptop even if both use the same Microsoft account. This is by design — PINs are local authentication that never leave the device. If you reset the PIN on one machine, it has no effect on any other machine.
This also means: if you’re locked out of a laptop PIN, the solution is on the laptop itself (NGC folder, using a password, TPM reset), not in your Microsoft account management page. Microsoft account passwords sync; PINs don’t and can’t be reset remotely.
Windows Hello for Business vs consumer Windows Hello
Windows Hello for Business (used on domain-joined machines in enterprise environments) has significantly more complex PIN management than consumer Windows Hello. WHfB uses certificate-based authentication and requires connectivity to on-premises domain controllers or Azure AD for credential provisioning.
Key differences in enterprise scenarios:
- PIN reset may require IT admin intervention or a self-service PIN reset portal configured by IT
- The NGC folder approach may not work if the credential is tied to an AD certificate that’s expired
- After a domain password change: the PIN may require re-provisioning through the Windows Hello for Business provisioning flow, not just a simple remove/re-add
- Hybrid Azure AD joined machines sometimes need both an internet connection and domain connectivity simultaneously for PIN to function
For enterprise PIN failures: document the exact error message and the machine’s join type (Azure AD joined, Hybrid Azure AD, on-premises domain) when reporting to IT — these details direct the administrator to the correct resolution path immediately.
A practical note for IT support teams handling multiple PIN failure tickets: the most efficient triage question is “can you sign in with your password?” If yes — the account is accessible, and the fix is remove/re-add PIN plus NGC folder cleanup if needed. If no — you have a broader authentication failure (corrupted user profile, password expired, domain connectivity, BitLocker recovery) that goes beyond the PIN itself. Separating these two scenarios at first contact prevents sending users through PIN-specific fixes when the real problem is elsewhere.
Keeping the PIN working long-term
A few practices that reduce PIN failures over time:
- Don’t change your Microsoft account password without logging into the device and updating the PIN afterward — the credential store can get out of sync otherwise
- After major Windows updates, sign in once with your password to confirm everything is working before relying on the PIN in time-sensitive situations
- If your machine uses BitLocker: ensure BitLocker recovery keys are saved to your Microsoft account or IT’s management portal — TPM changes that break the PIN sometimes also require BitLocker recovery key entry
- Keep at least one alternative sign-in method available (password or biometric) so a broken PIN never completely locks you out
One closing point: PIN-related lockouts feel more serious than they are because the sign-in screen looks like a dead end. But there’s almost always a way in — the password sign-in option, a different Windows Hello method, or the Recovery Environment. Working through these alternatives methodically (password first, then Settings PIN reset, then NGC folder, then TPM check) resolves Windows Hello PIN failures in the vast majority of cases without data loss or reinstallation. Our guide on Windows 11 Camera Not Working covers an adjacent issue.
