If you’ve already tried removing and re-adding the PIN and wiping the NGC folder, and the PIN still refuses to work, you’re past the basic layer. The problem now lives in the infrastructure around the PIN: Windows services, group policies, the TPM state, or the user profile itself. This guide picks up where the basic fixes leave off.

Work through these in order — each step targets a deeper layer than the last. None of these steps risk your files; the most invasive thing here is the TPM clear, and even that only affects stored keys, not your documents. The companion basic PIN fix guide covers the NGC wipe and TPM clear if you haven’t done those yet.

Why this happens

  • Disabled Hello dependency services. Tweaking tools often disable Credential Manager or CNG Key Isolation, silently breaking PIN setup.
  • Group policy blocking Windows Hello. Domain-joined or previously tweaked systems may have policies disabling Hello provisioning.
  • TPM not ready or owned by another OS. A TPM in a bad state blocks the key operations the PIN needs.
  • Corrupted user profile. Profile-level credential stores can break in ways a new account doesn’t share.
  • Damaged Hello system components. Corrupted files in the Hello stack survive NGC wipes because the code itself is broken.
  • Conflicting credential providers. Third-party security software can register providers that fight Windows Hello.
  • Stale cached credentials. The Credential Manager vault can hold outdated entries that conflict with Hello provisioning after a password change.

How to fix it

Work through these in order.

Fix 1: Verify the Hello dependency services

Check that nothing disabled the services PIN setup needs.

  1. Press Win + R, type services.msc, and press Enter.
  2. Find Credential Manager — set Startup type to Manual and start it if stopped.
  3. Find CNG Key Isolation — set it to Manual and start it.
  4. Find Windows Biometric Service — set to Manual; start it if you use biometrics.
  5. Try PIN setup again in Settings > Accounts > Sign-in options.

Fix 2: Check group policy for Hello blocks

Policies can silently disable Hello provisioning.

  1. Press Win + R, type gpedit.msc (Pro/Enterprise/Education editions), and navigate to Computer Configuration > Administrative Templates > System > Logon.
  2. Check Turn on convenience PIN sign-in — set it to Enabled or Not Configured.
  3. Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business and ensure nothing is forcing Hello off for your scenario.
  4. Run gpupdate /force in Terminal, restart, and retry PIN setup. On Home edition (no gpedit), the equivalent registry path is HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System — delete any AllowDomainPINLogon restrictions only if you added them yourself.

Fix 3: Reset the TPM state completely

Go deeper than a simple TPM clear when the TPM reports errors.

  1. Press Win + R, type tpm.msc, and check the status center panel — it should say “The TPM is ready for use.”
  2. If it reports errors or “not ready,” click Clear TPM in the Actions pane and restart, confirming at the prompt.
  3. After reboot, reopen tpm.msc and confirm the ready status.
  4. If the TPM still won’t ready, check the BIOS: ensure TPM/PTT/fTPM is enabled and not in a “owned by another OS” state, then clear it from the BIOS menu directly.

Fix 4: Remove conflicting credential providers

Third-party security tools can hijack the sign-in flow.

  1. Uninstall any third-party credential managers, SSO tools, or security suites you added — from Settings > Apps > Installed apps.
  2. Check the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers for leftover third-party GUIDs, and remove only entries you can positively identify as belonging to uninstalled software.
  3. Restart and test PIN setup with a clean provider list.
  4. Reinstall security software afterward only if needed, testing the PIN after each install.

Fix 5: Repair the Hello system components

When the Hello code itself is damaged, repair the OS files.

  1. In Terminal (Admin), run sfc /scannow.
  2. Then run DISM /Online /Cleanup-Image /RestoreHealth.
  3. Restart and retry PIN setup.
  4. If SFC reports it couldn’t fix some files, run DISM first and then SFC again — DISM repairs the source SFC draws from.

Fix 6: Test in a new user profile

Isolate profile-level corruption.

  1. Create a new local administrator account in Settings > Accounts > Other users.
  2. Sign into it and attempt PIN setup there.
  3. If it works, your original profile’s credential stores are damaged — migrate your files to the new account.
  4. If it fails there too, the problem is system-wide; continue to Fix 7.

Fix 7: Perform a repair install

The last software resort before suspecting hardware.

  1. Download the Windows 11 installation media from Microsoft’s download page .
  2. Run setup from within Windows and choose to keep personal files and apps.
  3. The repair install reinstalls Windows over itself, rebuilding the Hello stack cleanly.
  4. After completion, set up the PIN before installing third-party software, and test thoroughly. If even a repair install fails, the TPM chip itself may be faulty — check your warranty.

Closing

Advanced PIN troubleshooting is really about the layers most people never see: services, policies, TPM state, providers, profile. The NGC wipe fixes the data; these fixes repair the machinery around it.

One preventive note: be cautious with “privacy” and “debloat” scripts — disabling Credential Manager or CNG Key Isolation is one of the most common ways people break their own PIN setup without realizing it. If you’ve ever run such a script, the service checks in Fix 1 are worth doing even on a healthy system, just to confirm nothing was left disabled. On Lenovo laptops, the Lenovo-specific PIN guide covers model-specific quirks. And when everything here fails but a repair install feels like overkill, remember that switching to a local account (or a fresh profile) is a legitimate permanent solution — plenty of people run happily without Hello once the password sign-in works reliably.

Frequently asked questions

I deleted the NGC folder and the PIN still won't set up. What's next?
If the NGC wipe didn’t work, the problem is in the Hello infrastructure, not the PIN data: check that the TPM is ready in tpm.msc, verify the Credential Manager and CNG Key Isolation services are running, and look at group policy settings blocking Hello. Corrupted system files affecting the Hello stack are the next layer — run SFC and DISM.
Which Windows services does the PIN depend on?
The key ones are Credential Manager, CNG Key Isolation, and the TPM-related services, plus Windows Biometric Service if you use fingerprint or face. If any are disabled — sometimes by ‘privacy’ tweaking tools — Hello PIN setup fails silently or greys out. Set them to their defaults (Manual or Automatic) in services.msc.
Can a Windows update permanently break Windows Hello?
Updates can break Hello’s registration badly enough that only a repair install fixes it, but that’s rare. More often the update leaves the Hello provision in a half-migrated state that the NGC wipe plus a TPM clear resolves. Only consider a repair install after all service, policy, and TPM steps fail.
Does resetting my Microsoft account password affect my PIN?
It can. The PIN is bound to your account’s credentials on that device; changing the password online sometimes invalidates the binding, and Windows asks you to verify the new password before the PIN works again. Sign in with the new password once, then remove and re-add the PIN.