How to fix 0x80090027 (PIN isn't available) error in Windows

Error 0x80090027 means Windows Hello passed a value its key storage could not accept, so the key your PIN unlocks cannot be used and the PIN, face and fingerprint sign-in all stop. Sign in with your account password, remove the PIN, restart and set up a new one first.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2 with a Windows Hello PIN, read against Microsoft's Windows Hello PIN error table.

What error 0x80090027 means and where you see it

A Windows Hello PIN is not checked like a password. The PIN unlocks a secret key that Windows created for your account on this PC, usually inside the TPM security chip. Windows keeps the setup of that key in a system folder named Ngc. Error 0x80090027 is the cryptographic code NTE_INVALID_PARAMETER. Microsoft's Windows Hello error table describes it as Caller provided a wrong parameter: Windows asked the key storage to do something with a value it could not accept.

In practice that means the PIN data and the key no longer fit together. Your account and its password are fine, which is why the password still signs you in while the PIN, face and fingerprint sign-in all fail at once. Face and fingerprint depend on the PIN, so they go down with it.

What causes error 0x80090027, from the most common

Microsoft does not name a cause for this code, so the ranking is our reading of Microsoft's error table, the reports in Microsoft's own support forum and the old version of this guide, not a statistic. A typical report: the PIN broke a few weeks after an upgrade to Windows 11, and a reset PIN worked only until the next restart.

How to fix error 0x80090027

Every fix starts from a password sign-in, so make sure you know your account password or can reset it at account.microsoft.com from another device. The fixes go from the quickest and safest to the slowest. You are done when a new PIN still works after a full restart.

Fix 1. Sign in with the password, remove the PIN and set up a new one

5 minutesLow riskEveryone who can sign in with the account password, or reset it from the sign-in screen.

Removing the PIN makes Windows drop the old key setup, and adding a new PIN creates a new key. Microsoft's first steps for PIN errors are the same: try again, sign out and in, restart, then create the PIN again.

1. On the sign-in screen, press any key, select Sign-in options under the PIN box and select the key icon.
2. Type your account password and press Enter.
3. If you do not know the password of a Microsoft account, reset it at account.microsoft.com from a phone or another PC. For a local account, type any password, select OK, then Reset password and answer your security questions.
4. Once signed in, press Win + I and open Accounts > Sign-in options. Expand PIN (Windows Hello).
5. Select Remove, select Remove again and confirm with your password.
6. If Remove is grey, under Additional settings turn off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device. On Windows 10 it is Require Windows Hello sign-in for Microsoft accounts.
7. Restart the PC and sign in with the password again.
8. In Sign-in options, select PIN (Windows Hello) > Set up, confirm your password and choose a new PIN.
9. Restart once more and sign in with the new PIN.

Fix 2. Take ownership of the Ngc folder, empty it and add a new PIN

15 minutesRead the warningFix 1 did not last, or a new PIN fails after every restart. You must be able to sign in with a password to an administrator account.

Removing the PIN in Settings does not always delete the old key setup. Emptying the Ngc folder removes all of it, so Windows builds a fresh setup the next time you add a PIN.

1. Sign in with your password to an administrator account.
2. Open File Explorer with Win + E, select View > Show > Hidden items.
3. Go to C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft. Confirm the access prompt if one appears.
4. Right-click the Ngc folder and select Properties > Security > Advanced.
5. Next to Owner select Change, type your user name, select Check Names and OK.
6. Tick Replace owner on subcontainers and objects, then select Apply and OK.
7. Open the Ngc folder, select everything in it and delete it. Keep the empty Ngc folder itself.
8. Restart, sign in with the password and add a new PIN in Settings > Accounts > Sign-in options.

The same folder fix, with more detail on permissions, is in our guide to Windows login error 0x80090011, a neighbouring PIN code.

Fix 3. Check that the TPM is ready, especially after a BIOS update

5 minutesLow riskThe error started after a BIOS or firmware update, after a change in the firmware settings, or a new PIN fails every time.

The key the PIN unlocks usually lives in the TPM. A firmware update can reset the firmware TPM or switch it off, and then the old key cannot be used and a new PIN cannot be created.

1. Sign in with your password, press Win + R, type tpm.msc and press Enter.
2. Under Status, look for The TPM is ready for use.
3. If the console says that no compatible TPM is found, restart into the firmware settings and turn the TPM on. It is often called PTT on Intel PCs or fTPM on AMD PCs.
4. If the Actions pane offers Prepare the TPM, select it. Microsoft gives this step for the neighbouring code 0x80090029, TPM isn't set up.
5. When the TPM is ready, empty the Ngc folder (Fix 2) and set up a new PIN.

Fix 4. Uninstall the latest Windows update

15 minutesLow riskThe PIN broke right after a Windows update installed, and Fix 1 and Fix 2 did not hold.

In Microsoft's forum, the support answer for a PIN that broke after an update is to remove that update. It returns the sign-in components to the version that worked with your PIN.

If you can sign in with the password, remove the update from Settings. If you cannot sign in at all, use the recovery variant: hold Shift, select Power > Restart on the sign-in screen and go to Troubleshoot > Advanced options > Uninstall Updates. Step by step: How to uninstall a Windows update.

1. Open Windows Update. Select Start > Settings > Windows Update.
2. Open the update history. Under More options, select Update history. Note the KB number and the date of the update you suspect.
3. Open the list of removable updates. Scroll down to Related settings and select Uninstall updates.

   

4. Uninstall the update. Find the update in the list and select Uninstall next to it. If the update is not in the list, Windows does not allow it to be removed this way.

   

5. Pause updates. Go back to Settings > Windows Update and select Pick a date on the Pause updates control. If your PC shows a list there instead, select the pause length you prefer. Without a pause Windows downloads the same update again.

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to uninstall a Windows update

Fix 5. Disconnect from Microsoft Entra ID and join again (work or school PC)

15 to 30 minutesRead the warningThe PC belongs to a work or school organization and the error shows when you create the PIN. Do this with your IT administrator.

Microsoft's general steps for Windows Hello PIN errors end with this one: a new device registration lets Windows Hello for Business create a new key that matches it.

1. Sign in with your password and open Settings > System > About.
2. Select Disconnect from organization and confirm.
3. Restart and sign in with the local administrator account.
4. Join the PC again in Settings > Accounts > Access work or school > Connect, as IT tells you.
5. Sign in with the work account and set up the PIN in Settings > Accounts > Sign-in options.

Fix 6. Use System Restore or Startup Repair from the recovery screen

15 to 45 minutesLow riskYou cannot sign in at all, or the error started after a driver, a program or a cleanup tool and Fix 4 did not apply.

System Restore returns Windows settings, drivers and programs to a point from before the PIN broke, without touching your files, and it runs before you sign in.

1. Open the recovery environment. On the sign-in screen or in the Start menu, select Power, hold Shift and select Restart. For other ways, see Start Windows or a Mac in Safe Mode.

   

2. Go to Advanced options. Select Troubleshoot > Advanced options.

   

3. Select System Restore. Select System Restore. If the drive is encrypted, enter your BitLocker recovery key when asked.

   

4. Choose a restore point and finish. Select a restore point from before the problem, optionally Scan for affected programs, then select Next and Finish.
5. Restart. When the restore is done, select Restart.

These steps were written for Windows 11 and Windows 10, from the Windows Recovery Environment. The full page with the other versions and what each result means: Undo recent changes with System Restore

If there is no restore point, select Startup Repair on the same Advanced options screen. Step by step: Run Startup Repair.

Fix 7. Reinstall Windows and keep your files

1 to 2 hoursRead the warningNothing above helped. In Microsoft's forum this is the last answer given for 0x80090027 that returns after every PIN reset.

A reinstall that keeps your files replaces every Windows component, including the Windows Hello parts, while your documents stay where they are.

1. Open Recovery in Settings. Open Settings > System > Recovery. Next to Fix problems using Windows Update, select Reinstall now. This keeps your apps, files and settings.

   

2. Start the reinstall. Choose whether the PC may restart on its own 15 minutes after the installation, then select OK.
3. Wait and restart. Windows Update downloads and installs a repair copy of your current Windows version. Keep the PC plugged in and online, and restart it when asked.
4. If that did not help: Reset PC. Back in Settings > System > Recovery, next to Reset this PC, select Reset PC. This keeps your personal files but removes installed apps and settings.
5. Choose Keep my files. Select Keep my files. Do not select Remove everything.

   

6. Choose where Windows comes from. Select Cloud download to download a fresh copy of Windows, or Local reinstall to use the files already on the PC (faster, but may not include the latest updates).
7. Reset. Review the summary and select Reset. The PC restarts several times.

These steps were written for Windows 11 22H2 and later. The full page with the other versions and what each result means: Reinstall Windows without losing files

If error 0x80090027 is still there

As long as the password works, you are not locked out: you can keep using the PC without a PIN. Microsoft lists 0x80090027 as an error with no known mitigation and says to contact Microsoft Support, so collect what they, the PC maker or IT will ask for.

• The exact message and where it appeared: sign-in screen, Create a PIN, or a browser passkey prompt.
• Event Viewer: open Applications and Services Logs > Microsoft > Windows > HelloForBusiness > Operational and note the errors from the time of the failure.
• The TPM status: a picture of tpm.msc with its Status box, and the BIOS version from System Information (msinfo32).
• Work or school PC: run dsregcmd /status in Command Prompt and send the output to IT.
• Hardware: if a new PIN fails even after a reinstall and the TPM is not ready, contact the PC maker. A TPM or firmware fault is a warranty case, not a Windows setting.

How to keep error 0x80090027 from coming back

• Know your account password. It is the way back in whenever the PIN fails, so keep password sign-in allowed.
• Before a BIOS update, save the BitLocker recovery key and expect to set up the PIN again afterwards.
• Change or remove the PIN only in Settings, and let Windows finish before you restart.
• Do not let cleanup or tweaking tools touch C:\Windows\ServiceProfiles. The PIN data lives there.
• Keep a restore point: System Restore is the fastest way back when you are locked out.

Frequently asked questions

What is error code 0x80090027?

0x80090027 is the Windows cryptographic error NTE_INVALID_PARAMETER. Microsoft's Windows Hello error table describes it as Caller provided a wrong parameter and lists no fix, only a referral to Microsoft Support. On a home PC it means the PIN data no longer fits the key it should unlock. Sign in with your password, remove the PIN, restart and set a new one. If that does not last, empty the Ngc folder.

What does "Something went wrong and your PIN isn't available" mean?

It means Windows could not use the key your PIN unlocks, so it cannot sign you in with the PIN. The PIN you typed is not wrong and your account is fine. Select Sign-in options under the PIN box, choose the key icon and sign in with your password. Some builds say Something happened and your PIN isn't available; the fixes are the same.

Why does my new PIN stop working after a restart?

That is the most common report for 0x80090027: you sign in with the password, set a new PIN, and after the next restart the error is back. It usually means the old key setup in the Ngc folder was not removed, so the new PIN is saved on top of broken data. Empty the Ngc folder as in Fix 2, restart and add the PIN again. After a BIOS update, check the TPM too (Fix 3).

The PIN stopped working after a BIOS update. What happened?

A BIOS or firmware update can reset the firmware TPM or switch it off. The key your PIN unlocks lives there, so Windows can no longer use it and reports a PIN error. Sign in with the password, open tpm.msc and check for The TPM is ready for use. Turn the TPM on in the firmware if needed, then empty the Ngc folder and set up a new PIN. Keep your BitLocker recovery key at hand.

Is 0x80090027 the same as NTE_DEVICE_NOT_FOUND?

No. 0x80090027 is NTE_INVALID_PARAMETER in the Windows header winerror.h. NTE_DEVICE_NOT_FOUND is 0x80090035, which Microsoft explains as a policy that requires a TPM on a device without one. Both appear around Windows Hello, which is why searches mix them. If your screen says 0x80090027, start with the PIN fixes on this page; if it says 0x80090035, the work PC's policy or the TPM is the cause.

What does 0x80090027 mean in WebAuthNAuthenticatorGetAssertion?

WebAuthNAuthenticatorGetAssertion is the Windows function a browser calls when you sign in to a website with a passkey and Windows Hello. If Windows Hello cannot use its key, the call fails with the same 0x80090027. Fix the Windows Hello PIN first with Fix 1 or Fix 2. If the PIN works in Windows but one site still fails, remove that site's passkey and create it again. We could not find a Microsoft page that documents this case.

Can I sign in to Windows without the PIN?

Yes, with your account password. Select Sign-in options under the PIN box and choose the key icon. If you forgot the password of a Microsoft account, reset it at account.microsoft.com from another device. For a local account, a wrong password shows Reset password, which asks your security questions. There is no safe way around both the PIN and the password, by design.

Will deleting the Ngc folder delete my files?

No. The Ngc folder holds Windows Hello data only: the PIN, face and fingerprint setup of the accounts on the PC. Your documents, apps and browser passwords are not stored there. After you empty it, each user signs in with a password and sets up a PIN again. Delete only what is inside the folder, not the folder itself.

Is "error code 27" the same error?

Not necessarily. Some people shorten 0x80090027 to error 27, but many programs have their own error 27 that has nothing to do with Windows Hello. This page is about the Windows PIN message with the full code 0x80090027. If your error 27 comes from another program, search for that program's name with the code. For readers asking in other languages what the solution is: sign in with your password and set up a new PIN (Fix 1).