Login Problems
How to Fix Windows 11 PIN and Windows Hello Not Working: Resolving Error 0xd0000225 and NGC Corruption
By Rafvex
• Published
• 9 min read
Complete systems guide to fixing Windows Hello PIN sign-in crashes, TPM desynchronization, and corrupted Microsoft NGC folders without wiping your OS.
## Understanding the Windows Hello Cryptographic Architecture
When Windows Hello PIN or biometric sign-in suddenly fails with cryptic messages such as *"Something went wrong and your PIN isn't available"* or error codes **0xd0000225**, **0x80090016**, or **0x80280013**, the root cause is almost always desynchronization between the motherboard's **Trusted Platform Module (TPM 2.0)** and the operating system's local cryptographic key vault: the **NGC (Next Generation Cryptography) folder**.
Unlike traditional NTLM or Kerberos password hashes stored in the Security Account Manager (SAM) hive, a Windows Hello PIN does not simply compare plaintext or salted hashes. Instead, your PIN acts as the decryption key that releases an asymmetric RSA/ECC private key securely isolated inside the physical TPM hardware chip. When Windows executes a major cumulative update, a motherboard firmware (UEFI) flash, or a dual-boot partition change, the Platform Configuration Registers (PCRs) inside the TPM can shift. As a result, Windows rejects the local NGC container, locking you out of rapid biometrics and PIN authentication.
In this technical guide, our systems engineering desk walks through the exact diagnostic sequence to safely reconstruct the cryptographic NGC container and restore Windows Hello functionality without reinstalling Windows 11.
---
## Preliminary Diagnostic: Verifying TPM 2.0 Health
Before purging local encryption containers, you must confirm that the motherboard TPM hardware is communicating with the Windows kernel:
1. Press **Win + R**, type `tpm.msc`, and press **Enter**.
2. Examine the **Status** section in the center pane. You should see:
> *"The TPM is ready for use."*
3. Check the **TPM Manufacturer Information**: Specification Version must read **2.0**.
4. If `tpm.msc` reports *"Compatible TPM cannot be found"*, reboot into your computer's UEFI/BIOS settings and ensure that **Intel PTT (Platform Trust Technology)** or **AMD fTPM** is toggled to **Enabled**.
If the TPM is confirmed active and ready, proceed to the container recreation procedure.
---
## Step 1: Booting into Safe Mode or Accessing Local Administrator
Because the NGC folder is protected by the Windows `NT SERVICE\TrustedInstaller` and `SYSTEM` Access Control Lists (ACLs), you cannot modify or delete it from a standard unprivileged user session.
### Option A: Using Your Microsoft Password
If the sign-in screen offers a *"Sign-in options"* icon below the PIN prompt, click the **Password** icon (the key symbol) and authenticate using your full Microsoft account password or local account password.
### Option B: Entering Safe Mode with Command Prompt
If you cannot sign in to any desktop account:
1. On the Windows sign-in screen, hold the **Shift** key on your physical keyboard while clicking **Power > Restart**.
2. Navigate to: **Troubleshoot > Advanced Options > Startup Settings > Restart**.
3. Upon reboot, press **4** or **F4** to enter **Safe Mode**.
---
## Step 2: Purging and Rebuilding the Corrupted NGC Container
The physical container for Windows Hello keys is stored at:
`C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc`
Follow this exact terminal command sequence to seize file ownership and purge the invalid cryptographic tokens:
1. Right-click the **Start Menu** and select **Terminal (Admin)** or launch an elevated `cmd.exe`.
2. Stop the cryptographic background daemon:
```cmd
net stop CryptSvc
```
3. Take ownership of the restricted NGC directory:
```cmd
takeown /F "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc" /R /D Y
```
4. Grant full read/write/delete permissions to the local Administrators group:
```cmd
icacls "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc" /grant administrators:F /T
```
5. Delete all existing corrupted keys within the container:
```cmd
rd /s /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc"
```
6. Recreate a clean, uncorrupted directory container:
```cmd
md "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc"
```
7. Restart the Cryptographic Services daemon:
```cmd
net start CryptSvc
```
---
## Step 3: Re-registering the Windows Hello Provisioning Daemon
With the corrupted key vault obliterated, Windows needs to trigger its internal provisioning broker:
1. Press **Win + R**, type `services.msc`, and press **Enter**.
2. Locate the following three critical services and ensure their startup types are properly configured:
- **Windows Biometric Service (WbioSrvc)**: Set to *Automatic*, Status *Running*.
- **CNG Key Isolation (KeyIso)**: Set to *Manual* or *Automatic*, Status *Running*.
- **IPsec Policy Agent (PolicyAgent)**: Set to *Manual*.
If the **Windows Biometric Service** fails to start with Error 1067, navigate to `C:\Windows\System32\WinBioDatabase` and rename or delete the `.DAT` biometric database files (this resets saved fingerprints and facial recognition maps).
---
## Step 4: Re-enabling and Provisioning a Fresh PIN
Reboot your machine into standard Windows mode:
1. Sign in using your **Account Password**.
2. Open **Settings** (Win + I) > **Accounts** > **Sign-in options**.
3. Under **PIN (Windows Hello)**, the button should now display **Set up** (or **Change**).
4. Click **Set up**, authenticate with your primary Microsoft or domain password, and enter a new 6-digit or alphanumeric PIN.
5. Windows Hello will immediately execute a fresh cryptographic handshake with TPM 2.0, minting a new asymmetric keypair sealed within your hardware chip.
---
## Diagnostic Reference Matrix: Windows Hello Error Codes
| Error Code | Root Cause | Definitive Resolution |
| :--- | :--- | :--- |
| **0xd0000225** | NGC folder token desynchronization | Purge NGC container via elevated `icacls` / `rd` commands |
| **0x80090016** | Keyset does not exist / TPM PCR mismatch | Clear TPM in `tpm.msc` or UEFI, then recreate PIN |
| **0x80280013** | TPM hardware timeout / firmware collision | Update motherboard BIOS; disable Fast Startup |
| **0x80070490** | Element not found / Corrupted Biometric DB | Delete `C:\Windows\System32\WinBioDatabase\*.DAT` |
| **0x80070032** | The request is not supported / Azure AD policy | Re-link Work or School account in Account Settings |
---
## Technical Summary & Verification
By resetting the NGC directory rather than performing a destructive operating system reset, you preserve all personal applications, registry keys, and local app data while forcing Windows to re-provision fresh TPM-bound certificates. If you run Windows in an enterprise or Active Directory environment, ensure that your group policy (`Computer Configuration > Administrative Templates > System > Logon > Turn on convenience PIN sign-in`) is set to **Enabled**.
Verified Reader Feedback
Rated 4.9 / 5 stars based on 148 verified engineer and reader ratings.