[Fix] "This sign-in option is disabled because of failed sign-in attempts" error in Windows

This sign-in option is disabled because of failed sign-in attempts means the TPM security chip has locked your Windows Hello PIN, face and fingerprint for a while. Your account is not locked: sign in with the account password now, or keep the PC switched on at the sign-in screen for 2 hours and type the PIN once.

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2 with a Windows Hello PIN and a TPM 2.0 chip, read against Microsoft's TPM anti-hammering documentation.

What "This sign-in option is disabled" means

The full message on the Windows sign-in screen reads: This sign-in option is disabled because of failed sign-in attempts or repeated shutdowns. Use a different sign-in option, or keep your device powered on for at least 2 hours and then try again. Shorter forms show only the first sentence, which is why people search for "this sign-in option is disabled because of failed" and stop there.

A Windows Hello PIN does not go to a server. It unlocks a key stored in the TPM, the security chip of your PC. Microsoft's TPM documentation explains that the chip counts every failed attempt to use its keys and, after too many, locks for a while so that nobody can guess the PIN. While it is locked, Windows cannot check the PIN at all, so it shows this message even when you typed the right one.

Why the sign-in option is disabled, from the most common cause

Microsoft names two triggers in the message itself. The ranking below is our reading of the TPM documentation and of the reports in Microsoft's own forum, where hundreds of people say the message appeared after one correct PIN. It is not a statistic.

How to fix "This sign-in option is disabled" in Windows

Fix 1 and Fix 2 get you back in; Fix 4 and Fix 5 stop the message from coming back. Try the password first, because it costs two minutes and is not affected by the lock. Do not restart or shut down the PC while you wait: that pauses the timer.

Fix 1. Sign in with your account password instead of the PIN

2 minutesNo riskEveryone who knows the password of the account, or can find it out from another device.

The TPM lock blocks only the keys that the PIN, face and fingerprint unlock. Microsoft's TPM page says that when the TPM is locked you can use other credentials, such as a user name and password, so the password is checked normally.

1. On the sign-in screen, press any key and select Sign-in options under the PIN box.
2. Select the key icon. The PIN box changes to a Password box.
3. For a Microsoft account, type the password you use at outlook.com or account.microsoft.com, not the PIN.
4. For a local account, type the password you set when the account was created.
5. Press Enter. Check Caps Lock and the keyboard language shown in the corner of the screen if the password is refused.

Fix 2. Keep the PC switched on at the sign-in screen for 2 hours

2 hoursNo riskYou do not know the password but you know the PIN, and nobody else needs the PC for two hours.

Windows sets the TPM to forget failed attempts over time, but only while the PC is running, asleep or in a low power state. Microsoft says Windows does not require the chip to forget failures while the PC is fully off or hibernating, so a PC that is shut down never counts down.

1. Plug a laptop into its charger so it cannot run out of battery.
2. Start the PC and leave it on the sign-in screen. Do not type the PIN again.
3. Let the screen go dark if it wants to. A dark screen or sleep still counts, as long as the PC is not shut down.
4. Do not press the power button, restart or close the lid in a way that shuts the PC down.
5. After 2 hours, press a key, check that Num Lock is on if your PIN has digits, and type the PIN once, slowly.

Fix 3. Reset the account password from the sign-in screen or another device

5 to 10 minutesLow riskYou do not remember the password of the account but can still reach its email address, phone or security questions.

A new password gives you the sign-in option that the TPM lock does not block. For a Microsoft account the reset happens online, so the locked PC does not matter.

1. On the sign-in screen, select I forgot my PIN or, after choosing the key icon, I forgot my password.
2. For a Microsoft account, Windows opens the Microsoft sign-in window. Select Forgot my password, choose your email or phone and enter the code you receive.
3. Set a new password. You can do the same at account.microsoft.com from a phone or another computer.
4. Wait one or two minutes so the PC can reach the internet, then sign in with the new password using the key icon.
5. For a local account, type any password, select OK, then Reset password and answer your three security questions.

Fix 4. Remove the PIN and set up a new one after you sign in

5 minutesLow riskYou are signed in with the password and want the PIN back, or the message appeared without any wrong PIN.

A new PIN makes Windows create a new key for your account in the TPM. When the old PIN setup was damaged by a crash or an update, a fresh one stops the failed checks that keep feeding the lock.

1. Press Win + I and open Accounts > Sign-in options.
2. Expand PIN (Windows Hello) and select Remove. Confirm with your account password.
3. If Remove is grey, under Additional settings turn off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device, then close and reopen Settings.
4. Restart the PC and sign in with the password.
5. Open Accounts > Sign-in options again, select PIN (Windows Hello) > Set up and create the new PIN.
6. Restart once more and sign in with the new PIN to check that it lasts.

Fix 5. Check the TPM and clear old PIN data when the message keeps coming back

15 minutesRead the warningThe message appears after every restart, even after a new PIN, often after a Windows or BIOS update.

If the PIN data no longer matches the key in the TPM, every sign-in is a failed key check, and the chip keeps counting them. Microsoft's TPM page also says an administrator can reset the lockout from tpm.msc when the TPM owner password is stored on the PC.

1. Sign in with your password to an administrator account.
2. Press Win + R, type tpm.msc and press Enter.
3. Under Status, look for The TPM is ready for use. If the console offers to reset the TPM lockout, select it.
4. If the console asks for a TPM owner password you do not have, close it. A wrong owner password blocks further resets for 24 hours.
5. If the TPM is not ready or the message still returns, empty the Windows Hello PIN folder as described in our guide to PIN error 0x80090027, Fix 2, then set up a new PIN.

Fix 6. Reset Windows from the recovery screen and keep your files

1 to 2 hoursRead the warningYou know no password for any account on the PC, the reset of Fix 3 is impossible and the 2-hour wait did not help.

Reset this PC reinstalls Windows and lets you create a new account at the end, so it gets you back in without any old password. It is the last answer Microsoft's forum staff give when no password can be recovered.

1. On the sign-in screen, hold Shift and select Power > Restart.
2. On the blue Choose an option screen, select Troubleshoot > Reset this PC.
3. Select Keep my files.
4. Choose Cloud download or Local reinstall and follow the prompts. Enter the BitLocker recovery key if asked.
5. When setup finishes, create a new account and, if you want one, a new PIN.

If you can still sign in with any administrator account, back up first (Back up your files (Windows Backup, File History, Time Machine)) and use the Settings route instead, which can keep your apps too: Reinstall Windows without losing files.

If the sign-in option is still disabled

As long as the password works, you are not locked out: you can use the PC without a PIN while you sort out the cause. If even a new PIN locks again after every restart, collect what support or the PC maker will ask for.

• The exact message and whether it appears right after start or only after you type the PIN.
• The TPM status: a photo of tpm.msc with its Status box, and the BIOS version from System Information (msinfo32).
• Event Viewer: open Applications and Services Logs > Microsoft > Windows > HelloForBusiness > Operational and note the errors from the time of the failure.
• Work or school PC: the TPM owner password may be stored by your organization. Only IT can reset the lockout with it.
• Hardware: if tpm.msc says no compatible TPM is found, turn the TPM on in the firmware settings (often PTT on Intel or fTPM on AMD). If it is on and still fails, it is a case for the PC maker.

How to keep the sign-in option from being disabled again

• Know your account password and keep password sign-in possible. It is your way in whenever the PIN is locked.
• Do not hold the power button at the sign-in screen. Shut down from the power icon once Windows has loaded.
• Keep a laptop charged: a battery that dies during sign-in is a common start of the lock.
• Lock the PC with Win + L when children are around, instead of leaving the PIN box open to guesses.
• Save your BitLocker recovery key at account.microsoft.com before you ever need a reset.

Frequently asked questions

What does "This sign-in option is disabled because of failed sign-in attempts" mean?

It means the TPM security chip in your PC has paused the keys that your Windows Hello PIN, face and fingerprint use. The chip does this after too many failed attempts, and shutdowns during a PIN check can count too. Your account is not locked. Choose Sign-in options, then the key icon, and sign in with the account password, or keep the PC on for 2 hours and try the PIN once.

Why did I get the message after typing the correct PIN only once?

The count is kept by the TPM chip, not by the sign-in screen, so earlier failures still count. Shutdowns while Windows was checking the PIN, a battery that went flat, a child testing numbers or a damaged PIN setup can all add to it. Microsoft's forum is full of reports like yours. Sign in with the password, then remove the PIN and set up a new one (Fix 4).

Do the 2 hours have to be in one go?

Not exactly, but the PC must be on. Microsoft says the TPM forgets failures while Windows runs, sleeps or is in a low power state, and does not have to forget them while the PC is shut down or hibernating. Time spent switched off does not count. The easiest way is to plug in the charger and leave the PC on at the sign-in screen for 2 hours in one go.

Does a black screen during the wait reset the timer?

No. A screen that turns off, or a PC that goes to sleep, still counts toward the wait. Microsoft's support staff said the same in its forum: the screen goes dark to save power, but the PC is not off. What stops the countdown is a full shutdown, hibernation or a battery that runs out. Keep a laptop on its charger and do not press the power button.

How long am I locked out after failed sign-in attempts?

The message asks for at least 2 hours with the PC on. Microsoft's TPM documentation says a TPM 2.0 chip leaves the locked state after 10 minutes of running and forgets all failures after 320 minutes, but older settings or other chips can take longer. That is why Windows asks for 2 hours. If you know the password, you do not have to wait at all.

Which password does Windows want when I choose the key icon?

It depends on the account. For a Microsoft account it is the password of that account, the one you use for Outlook or account.microsoft.com, not the PIN. For a local account it is the password set when the account was created on this PC. If the Microsoft account password is refused, check that you are using the same email address, and reset it from another device if needed.

How do I turn off the sign-in option disabled lock or the 2-hour lockout?

You cannot turn it off at the sign-in screen, and you should not: it protects your PIN from guessing. Once you are signed in, an administrator can reset the lockout in tpm.msc if the TPM owner password is stored on the PC. Changing the account lockout threshold in secpol.msc, as some guides suggest, does not affect this TPM lock.

Why does my HP or ASUS laptop say this sign-in option is disabled?

The message comes from Windows and the TPM, not from the laptop maker, so HP, ASUS, Lenovo and other laptops show it the same way. Laptops get it more often because a flat battery or a held power button shuts them down during sign-in. The fixes on this page apply. If tpm.msc says no TPM is found, check the TPM setting in the BIOS.

Will resetting the PC delete my files?

Reset this PC with Keep my files keeps the documents in your user folders but removes installed apps and settings. Remove everything deletes the files. If the drive uses BitLocker, you need the recovery key, or the files cannot be read after the reset. Try the password, the password reset and the 2-hour wait first, because they keep everything.

What does this sign in option is disabled artinya mean, and what about password reset kaise kare?

Both are searches in other languages. Artinya is Indonesian for what it means, and the answer is that the TPM chip has paused the PIN after failed attempts or shutdowns. Password reset kaise kare is Hindi for how to reset the password: for a Microsoft account, use Forgot my password at account.microsoft.com, as shown in Fix 3 of this page.