How to fix Microsoft Teams error 657rx (Something went wrong) in Windows?

Something went wrong. [657rx] means Windows refused the sign-in it saved for Teams and the other Microsoft 365 apps, usually with the message The credential is invalid. Your account is almost always fine. Sign out, clear the Windows sign-in broker cache and reconnect your work or school account.

Facts checked on 15 October 2026. Steps written for the new Microsoft Teams and the Microsoft 365 apps on Windows 11 (25H2 and 26H2) and Windows 10 22H2, read against Microsoft's troubleshooting page for Microsoft 365 sign-in and TPM errors and the 657rx answers by Microsoft staff on Microsoft Q&A. We did not reproduce the error on a test PC.

What Something went wrong. [657rx] means in Microsoft Teams

You start Teams, or Teams asks for your account again, and a white Microsoft window says Something went wrong. [657rx]. The word in brackets is the tag: it marks where the sign-in stopped. Under it, the details read like this:

The details of a 657rx window, in the form posted on Microsoft Q&A (personal values removed)

Something went wrong. [657rx]
Correlation Id: (removed)
Timestamp: (removed)
DPTI: (removed)
Message: The credential is invalid. Unexpected sub status (6008).
Tag: 657rx
Code: 2148073494

The window is not drawn by Teams. Teams hands the sign-in to Windows, and the Windows account broker (the package Microsoft.AAD.BrokerPlugin) tries to use the token it saved for you. When Windows cannot unlock or read that token, every Microsoft 365 app on the PC shows the same tag. That is why Outlook or OneDrive often fail at the same moment, while teams.microsoft.com in a browser still works.

• Older windows label the last two lines Error Tag: 657rx and Error Code: 2148073494.
• The Code line changes, the tag does not. The code tells you which part of Windows failed, see the next section.
• A window with [1200] or another number in the brackets is a different tag. The reader's question above mentions both. We could not confirm what [1200] means, so this page covers only the 657rx tag.

Decode the Code line under tag 657rx: 2148073494 or 2148073520

Both codes that people post with 657rx are Windows cryptography codes written as decimal numbers. Converted to the usual hexadecimal form, they name the part of Windows that could not protect or read your sign-in key.

What causes Teams error 657rx, from the most common to the rare

Microsoft has not published a cause for 657rx. The order below is our reading of the Microsoft staff answers and the user reports on Microsoft Q&A, set against Microsoft's page for sign-in errors linked to the TPM. It is not a statistic.

How to fix Something went wrong. [657rx] in Teams on Windows

Before you start, open teams.microsoft.com in a browser and sign in. If that works, your account is fine and the fixes on the PC apply: go through Fix 1 to Fix 6 in order and try Teams after each one. If the browser refuses you too, go straight to Fix 7.

Fix 1. Sign out of the Office apps and clear the Windows sign-in broker cache

10 minutesLow riskEveryone first, above all when Teams, Outlook and OneDrive all show 657rx.

The tag means Windows cannot use the token in its broker cache. A Microsoft Q&A answer for 657rx deletes the contents of the broker's folder, and more than 60 people marked it helpful. Windows builds a fresh cache at the next sign-in.

1. In Word or Outlook select File > Account > Sign out. In Teams, if it opens, select your picture and Sign out.
2. Right-click the Teams icon in the corner of the taskbar and select Quit. Close Outlook, Word, Excel and OneDrive.
3. Press Win + R, paste this path and press Enter:

   %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

4. Press Ctrl + A to select every file and folder inside, right-click the selection and select Delete.
5. If Windows says a file is in use, restart the PC and repeat step 3 and step 4 before you open any app.
6. Restart the PC.
7. Start Word or Teams and sign in with your work or school address and your second factor.

Fix 2. Remove the Office and Teams credentials and reconnect your work or school account

10 minutesLow riskFix 1 did not help, the Code is 2148073520, or the error started after a password change.

Windows keeps your Microsoft 365 sign-in in two more places: Credential Manager and Access work or school. Microsoft's TPM troubleshooting page clears both, and the 657rx staff answer ends with Disconnect and Connect, which registers the device again with new keys.

1. Close Teams, Outlook, OneDrive and the other Office apps.
2. Select Start, type credential manager and open Credential Manager. Select Windows Credentials.
3. Under Generic Credentials, expand each entry that starts with MicrosoftOffice16 or names Teams, and select Remove.
4. Open Settings > Accounts > Access work or school.
5. If the account you use for Teams is listed and it is not your Windows sign-in, select it and select Disconnect.
6. Restart the PC. Users on the Q&A thread report that the restart after Disconnect was needed.
7. Go back to Access work or school, select Connect and sign in with your work or school address.
8. Start Teams and sign in.

Fix 3. Reset the Teams app and check for a Teams update

5 minutesLow riskOutlook and Word sign in, but Teams alone still shows 657rx.

A Microsoft Q&A answer for 657rx in Teams starts with clearing the Teams client cache, because damaged app data can hold an old sign-in. For the new Teams, Microsoft's way to clear that cache is a reset of the app in Settings.

1. Right-click the Teams icon in the taskbar corner and select Quit.
2. Open Settings > Apps > Installed apps and type Microsoft Teams in the search box.
3. Select the three dots next to Microsoft Teams and select Advanced options.
4. In the Reset section select Reset and confirm.
5. Start Teams and sign in.
6. Once Teams opens, select Settings and more (the three dots next to your picture) and select Check for updates.

A reset deletes the Teams app data and your personal Teams settings. Chats, files and meetings stay in the cloud. Every screen of the reset, with the Windows 10 path: How to repair or reset an app in Windows.

Fix 4. Test without VPN or proxy and empty the token store of the account plug-ins

10 minutesLow riskThe error appears on one network and not another, or a VPN or third-party security app runs on the PC.

Microsoft says some antivirus, proxy or firewall software can block the Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy process. If it is not blocked, Microsoft deletes only the token store of the two account plug-ins, a narrower step than Fix 1.

1. Disconnect the VPN, or connect the PC to a phone hotspot, and try the Teams sign-in once.
2. Open Settings > Network & internet > Proxy. If a manual proxy is on and you did not set it, switch it off for one test.
3. Pause your antivirus for one attempt only. For Microsoft Defender: Turn off Microsoft Defender protection for a moment.
4. Turn the protection, the proxy and the VPN back on, whatever the result.
5. If nothing was blocked, quit Teams and Office, open File Explorer and go to:

   %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts

6. Press Ctrl + A, delete the files, then do the same in:

   %LOCALAPPDATA%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\TokenBroker\Accounts

7. Restart the PC and sign in to Teams.

If the sign-in works only while a program is paused, keep the program and ask its maker or your IT department to allow the broker process. A paused antivirus is a test, not a fix.

Fix 5. Check the TPM after a BitLocker recovery, BIOS update or repair

15 minutesLow riskThe Code is 2148073520, or the error started after BitLocker recovery, a BIOS or TPM update, or a board repair.

Windows seals the sign-in keys with the TPM chip. When the chip was reset, updated or replaced, the old keys no longer open. Microsoft's TPM troubleshooting page lists a BIOS update and a check that the TPM is active.

1. Press Win + R, type tpm.msc and press Enter.
2. Under Status read the line. The TPM is ready for use is the healthy state.
3. If it says anything else, or Compatible TPM cannot be found, restart into the BIOS or UEFI setup and check that the TPM or security chip is turned on.
4. Install the latest BIOS or UEFI firmware from your PC maker's support site. On a Surface, firmware comes through Windows Update.
5. Run Fix 1 and Fix 2 again, so that Windows creates new keys with the working chip.

Fix 6. Test the sign-in from a new Windows user account

15 minutesLow riskFix 1 to Fix 5 did not help on a PC you own.

The broker cache, the credentials and the token keys belong to each Windows user. Microsoft's TPM page ends with a new Windows account, and one user on the 657rx thread reports that a new profile worked after a Windows 11 update.

1. Open Settings > Accounts > Other users and select Add account.
2. Select I don't have this person's sign-in information, then Add a user without a Microsoft account.
3. Give it a name and a password, then sign out and sign in to the new account.
4. Open Teams or Word and sign in with your work or school address.

If Teams signs in from the new account, your old profile holds the fault: move your files over, or ask IT to repair the profile. If it fails there too, the cause is the device or the account. Every screen: Create a new user account to test a problem.

Fix 7. On a work or school PC, send IT the details from the 657rx window

10 minutesNo riskThe browser refuses you too, your organisation blocks Disconnect, or the PC is company managed.

The Microsoft staff answer for 657rx says the cause is often an organisation setting such as a Conditional Access policy. A disabled or deleted device in Microsoft Entra ID ends the same way, and only an administrator can change it.

1. In the 657rx window, copy the Correlation Id, Timestamp, Tag and Code lines. Do not post the DPTI line publicly.
2. Select Start, type cmd, right-click Command Prompt and select Run as administrator.
3. Run dsregcmd /status and copy the output.
4. Send IT both, with which apps fail, whether teams.microsoft.com works, and what changed before the error.
5. Ask IT to check the sign-in logs for your Correlation Id and whether the device is enabled in Microsoft Entra ID > Devices.

If 657rx is still there: where to look and what to send

If the browser works and every fix failed, stop changing the PC and collect what support needs. The log that records the broker's failure sits in Event Viewer.

• Event Viewer: press Win + R, type eventvwr.msc, then open Applications and Services Logs > Microsoft > Windows > AAD > Operational. Look for errors at the time of your sign-in.
• For IT or Microsoft support: the Correlation Id, Timestamp, Tag and Code, the dsregcmd /status output, your Windows version, and what changed before the error.
• Microsoft's own tool: Microsoft's TPM page links the Microsoft 365 sign-in troubleshooter after the token store is cleared. Run it if your organisation allows it.

How to keep Something went wrong. [657rx] from coming back

Once the broker holds a fresh token sealed with the current TPM keys, the tag does not return by itself. These habits keep it that way.

• After a BitLocker recovery, a BIOS update or a TPM update, sign out of Office and run Fix 1 before you need Teams for a meeting.
• After a password change, lock the PC with Win + L and unlock it with the new password, then sign in to Teams.
• Do not delete Office or Teams credentials one by one. Remove them all and reconnect, as in Fix 2.
• Keep Windows and Teams updated, and let your PC maker's firmware updates install.
• On a VPN, make sure your security software allows Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy.

Frequently asked questions

What does Something went wrong. [657rx] mean in Teams?

It means Windows could not use the sign-in it saved for your Microsoft 365 account. Teams hands its sign-in to the Windows account broker, and the broker found its stored token invalid, which the message The credential is invalid says too. Microsoft publishes no definition of the tag. Your account is usually fine: if teams.microsoft.com works in a browser, the fault is the saved sign-in on this PC. Start with Fix 1.

Is 657rx a Teams error or a Windows error?

It is a Windows sign-in error that Teams shows. The same window, with the same tag, appears in Outlook, OneDrive, Word and Excel, because they all sign in through the Windows account broker. That is why fixing it in Teams alone, for example by reinstalling Teams, rarely helps. The useful fixes clear the broker cache, the stored credentials and the device registration, which affect every Microsoft 365 app at once.

What is error code 2148073494 with tag 657rx?

2148073494 is the decimal form of the Windows code 0x80090016, NTE_BAD_KEYSET, Keyset does not exist. Windows cannot find the key that sealed your saved sign-in, so the token cannot be opened. Clearing the broker cache (Fix 1) and reconnecting the work account (Fix 2) make Windows create new keys. If it started after a board repair or TPM change, see our guide to error code 2148073494 for the TPM steps.

What is error code 2148073520 with tag 657rx?

2148073520 is the decimal form of 0x80090030, NTE_DEVICE_NOT_READY. The security device that holds your sign-in key, normally the TPM chip, did not answer. Start with Fix 2, then check the TPM with Fix 5: tpm.msc should say The TPM is ready for use. A BIOS update or turning the security chip back on in the BIOS often follows. Our guide to sign-in error 2148073520 has the full order.

Why did 657rx appear after a BitLocker message?

BitLocker recovery and the sign-in tokens both depend on the TPM chip. In the Microsoft Q&A thread with the most answers on 657rx, the laptop first asked for a BitLocker recovery key, and after that the Office apps refused to sign in with Code 2148073494. Microsoft staff fixed it by clearing the broker cache and reconnecting the work account, Fix 1 and Fix 2 on this page.

Why does OneDrive or Outlook also say Something went wrong 657rx?

Because OneDrive and Outlook use the same Windows sign-in as Teams. When the broker's token for your work or school account is unusable, every app that asks for it shows the same window. You do not need a separate fix for each app. Sign out of all of them, clear the broker cache with Fix 1 and sign in once in Word or Teams. The other apps then pick up the new sign-in.

My organisation blocks Disconnect. What can I do?

Do what you can without Disconnect: sign out of the apps, clear the broker cache (Fix 1), remove the Office and Teams credentials (first half of Fix 2) and reset Teams (Fix 3). A user on Microsoft Q&A reported that Disconnect was blocked for all employees, even with administrator rights. In that case the device registration belongs to IT. Send them the Correlation Id, Timestamp, Code and the dsregcmd /status output, as in Fix 7.

Will reinstalling Teams fix error 657rx?

Rarely on its own. A reinstall replaces the Teams app, but the token that fails belongs to the Windows account broker, which Teams does not own. That is why Outlook and OneDrive keep failing after a Teams reinstall. A reset of the Teams app (Fix 3) is enough when only Teams fails. When several Microsoft 365 apps fail, clear the broker cache and reconnect the account first.

Is 657rx the same as 657x or rx657?

Yes, people type the tag in several ways. The window always prints it as 657rx in brackets, and as Tag: 657rx or Error Tag: 657rx in the details. Searches for 657x, 657 rx, error 657 or rx657 are the same error. If your window shows another value, such as 1200, it is a different tag, and the Code line under it decides which guide applies.