sodcalculator

10 Tech How-To

Fix Windows Hello Keeps Asking to Set Up PIN

Guide 10-9050 · Updated · Step by step

If Windows 11 keeps asking you to set up a PIN even after you have already created one, the fix is to reset the Windows Hello PIN through your account settings or by deleting the NGC folder. This guide walks you through the exact steps to stop the prompts and get Windows Hello working reliably again.

Why Windows 11 Keeps Asking for a PIN Setup

Windows Hello uses a PIN as a fast, secure sign-in method tied to your device, not your Microsoft account password. When the system repeatedly asks you to set up a PIN, it usually means the existing PIN data has become corrupted, the user profile is out of sync, or a group policy is forcing a PIN requirement. Common triggers include recent Windows updates, changes to your Microsoft account password, or leftover files from a previous setup that Windows no longer recognizes as valid.

How Windows Hello PIN Works

Windows Hello PIN is not stored on Microsoft’s servers; it is a local credential protected by the Trusted Platform Module (TPM) chip on your PC. The PIN is tied to the specific device and your account, which is why you cannot use the same PIN on another computer. When you sign in, Windows verifies the PIN against the TPM, and if the cryptographic keys become mismatched—often after an update or a password change—the system may invalidate the PIN and prompt you to create a new one. The prompt is Windows’ way of rebuilding a secure credential that it can trust again.

Fix 1: Reset Your PIN Through Settings

  1. Open Settings (Win + I) and go to Accounts > Sign-in options.
  2. Click PIN (Windows Hello) and then select I forgot my PIN.
  3. Follow the prompts to verify your identity using your Microsoft account password or an authenticator app.
  4. Create a new PIN. Make sure it meets the minimum length (usually 4 digits, but you can choose a longer one).
  5. Restart your PC and test whether the setup prompt appears again.

If the “I forgot my PIN� link is not visible, try signing in with your password and then repeat the steps. This method rebuilds the PIN from scratch and often resolves the loop.

Fix 2: Delete the NGC Folder (Advanced)

If resetting through Settings does not work, the PIN data may be corrupted at the system level. The NGC (Next Generation Credentials) folder stores the cryptographic keys for Windows Hello. Deleting it forces Windows to recreate the PIN entirely.

  1. Open File Explorer and navigate to C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC.
  2. If you see a permission prompt, click Continue to grant access. You may need to take ownership of the folder first.
  3. Right-click the NGC folder and select Delete. If it is in use, restart your PC and try again.
  4. After deletion, go to Settings > Accounts > Sign-in options and set up a new PIN.

Be careful: this removes all Windows Hello credentials, including fingerprint and face data, so you will need to reconfigure those as well. This method is safe for most users, but it is a deeper system change, so only use it if the first fix fails.

Fix 3: Check Group Policy or Registry Settings

On Windows 11 Pro or Enterprise, a local group policy might be forcing the PIN setup prompt. Use the Group Policy Editor to check:

  1. Press Win + R, type gpedit.msc, and press Enter.
  2. Navigate to Computer Configuration > Administrative Templates > System > Logon.
  3. Look for Turn on convenience PIN sign-in. If it is set to Disabled, change it to Enabled or Not Configured.
  4. Click OK and restart your PC.

If you are on Windows 11 Home, group policy is not available, but you can check the registry: navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System and look for a value named AllowDomainPINLogon. If it exists and is set to 0, change it to 1. Always back up the registry before making changes.

Fix 4: Update or Reinstall the TPM Driver

Since Windows Hello relies on the TPM chip, a driver issue can cause the PIN prompt to loop. Check for updates:

  1. Open Device Manager (right-click the Start button and select it).
  2. Expand Security devices and look for Trusted Platform Module 2.0.
  3. Right-click it and select Update driver > Search automatically for drivers.
  4. If no update is found, right-click and select Uninstall device, then restart your PC. Windows will reinstall the driver automatically.

Make sure TPM is enabled in your BIOS/UEFI. If it is disabled, Windows Hello will not work at all, and you may see the PIN setup prompt every time you sign in. Restart your PC, press the key to enter BIOS (often Del or F2), and look for a TPM or Intel Platform Trust Technology setting.

What to Do If the Prompt Persists After All Fixes

If you have tried all the above and the issue remains, consider these additional steps:

  • Create a new local administrator account and see if the prompt appears there. If not, the problem is tied to your original profile.
  • Run the Windows Update troubleshooter (Settings > System > Troubleshoot > Other troubleshooters) to fix any pending update issues.
  • Use System Restore to roll back to a point before the issue started, if you have a restore point.
  • Link your Microsoft account again by signing out of it in Settings > Accounts > Your info, then signing back in. This resyncs your credentials.

In rare cases, a corrupted user profile may require creating a new account and migrating your files. This is a last resort, but it usually resolves any persistent sign-in issues.

Frequently Asked Questions

Why does Windows 11 ask for a PIN every time I restart?

This usually happens because the PIN data is not being saved correctly, often due to a pending Windows update or a corrupted NGC folder. The fixes above—especially resetting the PIN or deleting the NGC folder—should resolve it. If the prompt appears only after a restart, also check that your account is not set to require a password on wakeup (Settings > Accounts > Sign-in options > “If you’ve been away, when should Windows require you to sign in again?�).

Will deleting the NGC folder remove my fingerprint or face data?

Yes, deleting the NGC folder removes all Windows Hello credentials, including PIN, fingerprint, and facial recognition data. You will need to set them up again after the deletion. This is safe, but it is a more aggressive fix, so try the Settings reset first.

Can I use a password instead of a PIN to sign in?

Yes, you can disable Windows Hello PIN entirely by going to Settings > Accounts > Sign-in options, selecting PIN (Windows Hello), and clicking Remove. You will then sign in with your Microsoft account password. However, some features like Windows Hello for apps may not work without a PIN.

Why does the PIN setup prompt appear on a work or school PC?

If your device is managed by an organization, IT policies may require a PIN or block its removal. The group policy fix described above may not work if the policy is enforced by the organization. Contact your IT administrator for assistance, as they may need to update the policy or re-enroll your device.

Is it safe to delete the NGC folder?

Yes, it is safe for most users. The folder only contains Windows Hello cryptographic keys, and Windows will recreate it when you set up a new PIN. Just be aware that you will need to reconfigure any biometric sign-ins. Always back up important data before making system-level changes, although this particular folder is not user data.

Related

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →