Error 0x801c044f when setting up a Windows PIN: how to fix it

What 0x801c044f means

Microsoft publishes a table of error codes you can see while creating a Windows Hello PIN. The codes on either side of this one (0x801C044C, 0x801C044D and 0x801C044E) are listed there, but 0x801C044F is not, and Microsoft’s advice for codes it doesn’t list is to contact Microsoft Support. Some sites give it an official-sounding meaning; that is guesswork.

What users report is consistent, though. The code shows up in Settings > Accounts > Sign-in options when adding or changing a PIN, and in one work-PC log it appears next to the message that Windows was unable to get a token using the Web Account Manager. Windows needs a fresh sign-in token, and on work PCs a recent second-factor check, before it will create a PIN. Microsoft’s description of Windows Hello for Business provisioning says users must provide two factors of authentication and that the registration service checks the MFA claim is still current. So the fixes below aim at the account and sign-in side, not at the PIN itself.

Which kind of PC are you on?

Open Settings > Accounts > Access work or school. If you see a work or school account that says Connected to an organisation’s Microsoft Entra ID (Azure AD), follow the work PC section; your IT team controls Windows Hello on that PC. If the list is empty or only shows an account you added for email or Teams, you’re on a personal PC. Our guide to Access work or school explains the different connection types.

Try the basic PIN steps first

For PIN errors in general, Microsoft suggests these steps in order:

1. Try to create the PIN again.
2. Sign out, sign back in with your password, and try again.
3. Restart the PC and try again.
4. On a work PC that is joined to Microsoft Entra ID, disconnect and rejoin it. That last step needs an IT admin account and is covered below.

Install pending updates in Settings > Windows Update before the restart, so you’re not retrying on an out-of-date build.

Fixes on a personal PC

Switch to a local account and back

This is the fix a Microsoft support agent suggested on Microsoft Q&A, and the one with the most positive replies from users, although it doesn’t work for everyone. Make sure you know your Microsoft account password before you start.

1. Go to Settings > Accounts > Your info.
2. Select Sign in with a local account instead, follow the prompts, and set a local password.
3. Restart, sign in with the local account, then go back to Your info and select Sign in with a Microsoft account instead.
4. Restart again and try adding the PIN in Settings > Accounts > Sign-in options.

The likely reason it helps: the switch makes Windows sign your Microsoft account in from scratch and request a new token.

Remove extra work or school accounts

If you added a work or school account to a personal PC (often for Outlook or Teams), it can interfere with sign-in tokens. In Access work or school, select the account, choose Disconnect, restart and set the PIN. You can add the account back afterwards. If Office apps then complain about sign-in, see the Microsoft authentication broker fix.

Reset the Windows Hello key store

If none of that works, clearing the Ngc folder makes Windows start Windows Hello from nothing. It removes every PIN, fingerprint and face sign-in on the PC, so only do it when you can sign in with your password. The steps, with the commands to take ownership of the folder, are in Your PIN is no longer available: clear the Ngc folder.

As a final test, create a new local user account and try to set a PIN there. If it works, the problem is in your account’s settings; if it fails too, it’s PC-wide and an in-place repair of Windows is the next step.

Fixes on a work or school PC

On a managed PC, Windows Hello for Business is set up by your organisation, so most fixes are for IT. Two reports, both from community forums rather than Microsoft, tie 0x801c044f to the MFA step:

• An admin found that a user who had been excluded from MFA hit the error in a loop, because Windows requires the MFA claim and the bypass made it fail.
• Another admin fixed it on a new Entra-joined Windows 11 laptop by resetting the user’s MFA methods in Microsoft Entra.

So the first thing to ask IT is to check that your account has working MFA methods and isn’t excluded from MFA or blocked by a Conditional Access policy when you register Windows Hello.

Information to give IT

1. Open Command Prompt as your normal user (not as administrator) and run dsregcmd /status. Microsoft notes that some user values show errors if you run it elevated.
2. Note AzureAdJoined or DomainJoined under Device State, and under User State NgcSet and WamDefaultSet. In the SSO State section, note AzureAdPrt. A NO for AzureAdPrt points to a sign-in token problem rather than a PIN one.
3. In the Ngc Prerequisite Check section, PreReqResult should read WillProvision. If it doesn’t, the other lines in that section say which prerequisite is missing.
4. In Event Viewer, open Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin and look for errors at the time you tried to set the PIN.

If IT asks you to rejoin the device, they will use Settings > System > About and the option to disconnect from the organisation, which needs a local admin account to sign back in. Don’t do this on your own. For join errors after that, see error 0x801c001d.

Steps to skip

Many guides for this code suggest enabling Turn on convenience PIN sign-in in Group Policy. That editor isn’t available on Windows 11 Home, the setting applies to domain PIN sign-in, and nothing links it to this error. System Restore and Reset this PC are also offered as fixes, but there’s no evidence the code comes from damaged system files, so try everything above first. If you just need to get in, your password still works; see PIN: this option is currently unavailable for related Windows Hello problems.

Related guides

• Your PIN is no longer available due to a change: how to fix it
• Windows Hello PIN “This option is currently unavailable”: how to fix it
• This sign-in option is disabled: how to fix it in Windows 11 and 10
• Access work or school in Windows 11 and 10: add, check and disconnect accounts

Official sources

• Windows Hello errors during PIN creation (Microsoft Learn)
• How Windows Hello for Business provisioning works (Microsoft Learn)
• Troubleshoot devices by using the dsregcmd command (Microsoft Learn)