Windows Hello PIN “This Option Is Currently Unavailable”: How to Fix It

Applies to: Windows 11 and Windows 10, when Settings > Accounts > Sign-in options shows “This option is currently unavailable” for PIN, fingerprint or facial recognition, or the Set up, Add or Remove button is greyed out.

Why Windows Hello says the option is unavailable

Windows Hello keeps your PIN and biometric data in a protected folder tied to the PC’s security chip (TPM). The message appears when Windows decides that a sign-in method can’t be added, changed or removed right now. The usual reasons are:

What you’re trying to do	Most likely cause
Remove the PIN	The “only allow Windows Hello sign-in” setting is on (Fix 2)
Add a PIN on a work or school PC	Your organisation’s policy (Fix 3)
Add a PIN on a home PC	A Group Policy setting or damaged Windows Hello data (Fixes 4 and 5)
Use fingerprint or face	Missing driver, stopped service or no PIN set up first (Fix 6)

Before you start, make sure you know your account password. If you sign in with a Microsoft account, you can check or reset the password from another device at account.microsoft.com.

Fix 1: Restart, update and sign in with your password

1. Restart the PC. On the sign-in screen, select Sign-in options and choose the password (key) icon instead of the PIN.
2. Go to Settings > Windows Update and install any pending updates, then restart again.
3. Return to Settings > Accounts > Sign-in options and try again.

Microsoft notes that Windows sometimes asks you to set up the PIN again after security updates or system changes, so a PIN that suddenly stopped working may just need to be created again.

Fix 2: Turn off the “only allow Windows Hello sign-in” setting

If the Remove button under PIN is greyed out, this setting is usually why. It stops you removing the PIN, because the PIN is then the only way to sign in.

1. Go to Settings > Accounts > Sign-in options.
2. Under Additional settings, turn off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device. On Windows 10 the setting is called Require Windows Hello sign-in for Microsoft accounts.
3. Close and reopen Settings. The Remove button under PIN (Windows Hello) should now work.

Fix 3: Check for work or school management

On a PC owned or managed by an employer or school, the organisation decides which sign-in methods are allowed. Go to Settings > Accounts > Access work or school. If an account is listed there, the PIN option may be controlled by your IT department, and they’re the people to ask.

If it’s your own PC and you added a work account only to use Outlook or Teams, that account can still apply policies. Disconnecting it removes access to the organisation’s resources on this PC, so check with your IT team first. If device management itself shows an error, see Device management could not be enabled.

Fix 4: Check the Group Policy settings

On Windows Pro, Enterprise and Education, local policies can turn off the PIN or biometrics. Press Win + R, type gpedit.msc and check these settings under Computer Configuration > Administrative Templates:

Policy	Location	Setting to use
Turn on convenience PIN sign-in	System > Logon	Enabled (needed on domain-joined PCs)
Use Windows Hello for Business	Windows Components > Windows Hello for Business	Not Configured, unless your organisation set it
Allow the use of biometrics	Windows Components > Biometrics	Not Configured or Enabled

Restart after changing a policy. Windows Home doesn’t include the Group Policy editor, but the convenience PIN setting is stored in the registry. To turn it on from an administrator Command Prompt, run:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowDomainPINLogon /t REG_DWORD /d 1 /f

This setting mostly matters on PCs joined to a company domain. On a home PC that has never been on a domain, it’s rarely the cause, so try Fix 5 if nothing changes.

Fix 5: Reset the Ngc folder

Windows Hello stores PIN data in a folder called Ngc. If it’s damaged, Windows can’t create or change a PIN. Renaming it makes Windows start fresh. This removes the PIN, fingerprints and face data for every account on the PC, so everyone will need to sign in with their password and set Windows Hello up again.

1. Sign in with your password, not the PIN.
2. Open Command Prompt as administrator.
3. Run the commands below one at a time. The first takes ownership of the folder, the second gives the Administrators group full access (the code works in any Windows language), and the third renames it.
4. Restart, then go to Settings > Accounts > Sign-in options and set up the PIN again.

takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /r /d y
icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /grant *S-1-5-32-544:F /t
ren C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc Ngc.old

If takeown uses a different confirmation letter in your language, answer the prompt manually instead of using /d y. The same ownership steps are explained in “You don’t currently have permission to access this folder”. Once the new PIN works, you can delete the Ngc.old folder.

Fix 6: Fingerprint or face shows the message

• Set up a PIN first. Windows Hello fingerprint and face sign-in need a PIN as a backup, so they stay unavailable until the PIN works.
• Check the driver. Right-click Start, open Device Manager and expand Biometric devices. If the reader is missing or has a warning icon, install the driver from your PC maker’s support page. For face sign-in, the camera must support Windows Hello (an infrared camera).
• Check the service. Press Win + R, type services.msc and make sure Windows Biometric Service isn’t disabled. Its startup type is normally Manual or Automatic.
• Re-register. Remove the fingerprint or face under Sign-in options and set it up again. Microsoft also suggests registering more than one finger and keeping the reader clean and dry.

Fix 7: Check the TPM and repair Windows

Press Win + R, type tpm.msc and check that the status says The TPM is ready for use. If it says no compatible TPM was found, check that the TPM (Intel PTT or AMD fTPM) is turned on in the BIOS. After a CPU or motherboard change, see New CPU installed, fTPM NV corrupted.

Don’t clear the TPM just to fix the PIN. Clearing it can lock you out of BitLocker-encrypted drives unless you have the recovery key.

Finally, repair Windows files from an administrator Command Prompt with DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow. If SFC can’t finish, see Windows Resource Protection could not perform the requested operation.

Related guides

• “The referenced account is currently locked out”: how to fix it
• “You don’t currently have permission to access this folder”: how to fix it
• Device management could not be enabled: how to fix it
• New CPU installed, fTPM NV corrupted or fTPM NV structure changed
• Windows Resource Protection could not perform the requested operation (SFC and DISM)

Official sources: for more detail, see Microsoft’s own documentation:

• Microsoft Support: Troubleshoot problems with Windows Hello
• Microsoft Support: Change or reset your PIN in Windows

Frequently asked questions

Why can’t I remove my Windows Hello PIN?

Usually because only allow Windows Hello sign-in for Microsoft accounts is turned on. Turn it off under Settings > Accounts > Sign-in options > Additional settings and the Remove button becomes available.

Will resetting the Ngc folder delete my files?

No. It only removes Windows Hello sign-in data. Your files, apps and account stay as they are, but you’ll need your password to sign in until you set up a new PIN.

Is a Windows Hello PIN the same as my password?

No. The PIN only works on the PC where you created it, while your password works anywhere you sign in with that account. That’s why Windows treats a PIN as more secure for everyday sign-in.

I forgot my PIN. What should I do?

On the sign-in screen, select I forgot my PIN and follow the steps, or sign in with your password and choose I forgot my PIN under Settings > Accounts > Sign-in options > PIN (Windows Hello).