How to fix Windows login error 0x80090011

Error 0x80090011 means Windows could not find the key container that your Windows Hello PIN unlocks, so the PIN stops working at sign-in, in administrator prompts or when you set it up. Sign in with your account password, remove the PIN, restart and add a new one first.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2 with a Windows Hello PIN, read against Microsoft's Windows Hello PIN error table.

What error 0x80090011 means and where you see it

A Windows Hello PIN is not checked like a password. The PIN unlocks a secret key that Windows created for your account and stored on this PC, usually protected by the TPM security chip. Windows keeps the setup of that key for every account in a system folder named Ngc. Error 0x80090011 is the cryptographic code Microsoft describes as The container or key wasn't found: Windows looked for your key container and it was not there or could not be read.

That is why the PIN fails while your account and its password are fine. A Microsoft support moderator describes the code the same way: the PIN credential data is corrupted, and Windows cannot use the PIN for sign-in, administrator approval or app installation, even when Settings still shows the PIN as set up.

What causes error 0x80090011, from the most common

The ranking is our reading of Microsoft's PIN error table, Microsoft's support answers and the reports behind the old version of this guide, not a statistic. The key question is whether you can still sign in with a password: if you can, the fix is quick.

How to fix error 0x80090011

All fixes start from a password sign-in, so make sure you know your account password or can reset it at account.microsoft.com from another device. The fixes go from the quickest and safest to the slowest. You are done when Windows accepts a new PIN and signs in with it after a restart.

Fix 1. Sign in with the password, remove the PIN and set up a new one

5 minutesLow riskEveryone who can sign in with the account password or reset the PIN from the sign-in screen.

Removing the PIN makes Windows drop the PIN's key setup, and adding one creates a new key container. Microsoft's own first steps for PIN creation errors are the same: try again, sign out and in, restart, then create the PIN again.

1. On the sign-in screen select Sign-in options, select the key icon and sign in with your account password.
2. If you only see the PIN box, select I forgot my PIN below it, confirm your Microsoft account password and follow the prompts to set a new PIN. If that works, you are done.
3. Once signed in, open Settings > Accounts > Sign-in options and expand PIN (Windows Hello).
4. Select Remove and confirm with your password.
5. If Remove is grey, under Additional settings turn off For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device. On Windows 10 it is Require Windows Hello sign-in for Microsoft accounts.
6. Restart the PC and sign in with the password again.
7. In Sign-in options, select PIN (Windows Hello) > Set up and choose a new PIN.
8. Lock the PC with Win + L and sign in with the new PIN.

Fix 2. Take ownership of the Ngc folder, empty it and add a new PIN

15 minutesRead the warningFix 1 did not help, or Settings shows the PIN as set up but every use fails with 0x80090011. You must be able to sign in with a password.

This is the fix a Microsoft support moderator gives for 0x80090011: it deletes the damaged PIN data, so Windows builds a fresh key container the next time you add a PIN. It removes what Fix 1 cannot reach.

1. Sign in with your password to an administrator account.
2. Open File Explorer and go to C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft. Confirm the access prompt if one appears.
3. Right-click the Ngc folder and select Properties > Security > Advanced.
4. Next to Owner select Change, type your user name, select Check Names and OK.
5. Tick Replace owner on subcontainers and objects, then select Apply and OK.
6. Open the Ngc folder, select everything in it and delete it. Keep the empty Ngc folder itself.
7. Restart the PC, sign in with the password and add a new PIN in Settings > Accounts > Sign-in options.

We cover the same folder in more detail, including a permission reset with icacls, in our guide to The device that is required by this cryptographic provider is not ready for use.

Fix 3. Disconnect from Microsoft Entra ID and join again (work or school PC)

15 to 30 minutesRead the warningThe PC is joined to a work or school organization and the error shows when you create the PIN. Do this with your IT administrator.

This is the one mitigation Microsoft lists for 0x80090011 in its Windows Hello PIN error table. Rejoining gives the device a new registration, so Windows Hello for Business can create a new key container that matches it.

1. Sign in with your password.
2. Open Settings > System > About. On Windows 10 it is Settings > System > About as well, with the link under Related settings.
3. Select Disconnect from organization and confirm with Continue.
4. Restart and sign in with a local administrator account.
5. Join the PC again in Settings > Accounts > Access work or school > Connect, as IT tells you.
6. Sign in with the work account and set up the PIN in Settings > Accounts > Sign-in options.

Fix 4. Check that the TPM is ready in tpm.msc

5 minutesLow riskFix 1 and Fix 2 did not help, or you changed BIOS or TPM settings recently.

The key the PIN unlocks usually lives in the TPM. If the TPM was turned off, cleared or is not ready, Windows cannot find the key, and a new PIN fails too.

1. Press Win + R, type tpm.msc and press Enter.
2. Under Status, look for The TPM is ready for use.
3. If it says that no compatible TPM is found, open the PC's firmware settings and check that the TPM (often called PTT on Intel or fTPM on AMD) is turned on.
4. If the console reports another state, follow our TPM guide from its Fix 2.
5. When the TPM is ready, set up the PIN again as in Fix 1.

Fix 5. Use System Restore or Startup Repair from the recovery screen

15 to 45 minutesLow riskYou cannot sign in at all, or the error started right after an update, a driver or a cleanup tool.

System Restore returns Windows settings, drivers and programs to a restore point from before the PIN broke, without touching your files. It works from the recovery screen, so you do not need to sign in first.

1. On the sign-in screen, hold Shift and select Power > Restart.
2. Select Troubleshoot > Advanced options > System Restore and pick a restore point from before the error started.
3. If there is no restore point, select Startup Repair on the same screen instead.

1. Choose a restore point and finish. Select a restore point from before the problem, optionally Scan for affected programs, then select Next and Finish.
2. Restart. When the restore is done, select Restart.

These steps were written for Windows 11 and Windows 10, from the Windows Recovery Environment. The full page with the other versions and what each result means: Undo recent changes with System Restore

Fix 6. Repair Windows system files with DISM and SFC

20 minutesLow riskOther sign-in or security features fail as well, or Fix 1 to Fix 5 did not help.

Windows Hello depends on system components. If one of them is damaged, Windows can lose track of the key container; DISM and SFC replace damaged files with good copies.

If you can sign in with the password, run the scan from Windows. If you cannot, use the recovery variant of the procedure: there the commands must point at your Windows drive, because the recovery screen runs its own copy of Windows. Step by step: Run DISM and SFC to repair Windows system files.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 7. Reinstall Windows and keep your files

1 to 2 hoursRead the warningNothing above helped and you can sign in with a password, or you are locked out and System Restore failed.

A reinstall that keeps your files replaces every Windows component, including the Windows Hello parts, while your documents stay where they are.

1. Open Recovery in Settings. Open Settings > System > Recovery. Next to Fix problems using Windows Update, select Reinstall now. This keeps your apps, files and settings.

   

2. Start the reinstall. Choose whether the PC may restart on its own 15 minutes after the installation, then select OK.
3. Wait and restart. Windows Update downloads and installs a repair copy of your current Windows version. Keep the PC plugged in and online, and restart it when asked.
4. If that did not help: Reset PC. Back in Settings > System > Recovery, next to Reset this PC, select Reset PC. This keeps your personal files but removes installed apps and settings.
5. Choose Keep my files. Select Keep my files. Do not select Remove everything.

   

6. Choose where Windows comes from. Select Cloud download to download a fresh copy of Windows, or Local reinstall to use the files already on the PC (faster, but may not include the latest updates).
7. Reset. Review the summary and select Reset. The PC restarts several times.

These steps were written for Windows 11 22H2 and later. The full page with the other versions and what each result means: Reinstall Windows without losing files

If error 0x80090011 is still there

As long as the password works, you are not locked out: you can keep using the PC without a PIN. Before you try anything bigger, collect what Microsoft Support, the PC maker or IT will ask for.

• The exact message and where it appeared: sign-in screen, Create a PIN, or an administrator prompt.
• Event Viewer: open Applications and Services Logs > Microsoft > Windows > HelloForBusiness > Operational and note the errors from the time of the failure.
• The TPM status: a picture of tpm.msc with its Status box, or of Windows Security > Device security > Security processor details.
• Work or school PC: run dsregcmd /status in Command Prompt and send the output to IT. It shows whether the device is joined to Microsoft Entra ID.
• Hardware: if a new PIN fails even after a reinstall and the TPM is not ready, contact the PC maker. A TPM fault is a warranty case, not a Windows setting.

How to keep error 0x80090011 from coming back

• Know your account password. It is the way back in whenever the PIN fails. Keep the setting that allows a password sign-in on.
• Change or remove the PIN only in Settings, never by deleting files, and let Windows finish before you restart.
• Do not let cleanup or tweaking tools touch C:\Windows\ServiceProfiles. The PIN data lives there.
• Keep the TPM settings unchanged in the firmware unless the PC maker tells you otherwise, and keep the BitLocker recovery key at hand.
• Keep a restore point: System Restore is the fastest way back when you are locked out.

Frequently asked questions

What is error code 0x80090011?

0x80090011 is a Windows cryptographic error that Microsoft describes as The container or key wasn't found. You see it when a Windows Hello PIN cannot be used or created, usually because the PIN data in the Ngc folder is damaged. Sign in with your password, remove the PIN, restart and set a new one. If that fails, empty the Ngc folder, and on a work PC rejoin Microsoft Entra ID.

What does "Something went wrong and your PIN isn't available" mean?

It means Windows could not use the key that your PIN unlocks, and code 0x80090011 says the key was not found. Your PIN itself is not wrong and your account is fine. Choose Sign-in options on the sign-in screen and use your password, or select I forgot my PIN. After you sign in, set up a new PIN as in Fix 1.

Why does 0x80090011 show when I install an app or run something as administrator?

On many PCs the User Account Control prompt asks for your Windows Hello PIN to approve administrator actions. If the PIN data is broken, that prompt fails with 0x80090011 too, so installs stop. In the prompt choose more choices and use your password, then rebuild the PIN with Fix 1 or Fix 2. A Microsoft support moderator points to the Ngc folder for exactly this case.

I removed the PIN and set it up again, but 0x80090011 is still there. What now?

Removing the PIN in Settings does not always delete the damaged key container. Take ownership of the Ngc folder in C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft, delete what is inside, restart and add the PIN again (Fix 2). On a work or school PC, the next step is to disconnect from the organization and join again with IT (Fix 3).

How do I fix 0x80090011 on Windows 11?

The fixes are the same on Windows 11 and Windows 10. Sign in with the password through Sign-in options, remove the PIN in Settings > Accounts > Sign-in options, restart and set a new PIN. If the error returns, empty the Ngc folder. On Windows 11, Disconnect from organization is under Settings > System > About when the PC belongs to a work or school account.

Can I get past the PIN screen without the PIN?

Yes, with your account password. Select Sign-in options under the PIN box and choose the key icon. If only the PIN box shows, select I forgot my PIN and confirm your Microsoft account. If you do not know the password of a Microsoft account, reset it at account.microsoft.com from another device. There is no safe way around both the PIN and the password, by design.

Will deleting the Ngc folder delete my files?

No. The Ngc folder holds Windows Hello data only: the PIN, face and fingerprint setup of the accounts on the PC. Your documents, apps and saved browser passwords are not stored there. After you empty it, each user signs in with a password and sets up a PIN again. Delete only what is inside the folder, not the folder itself.

Is 0x80090011 the same as 0x80090010 or 0x80090030?

No, they are neighbouring codes from the same family. Microsoft lists 0x80090010 as NTE_PERM, a permission error with no documented mitigation. The code 0x80090030 means the security device, usually the TPM, is not ready. We cover it in our guide to the cryptographic provider error. The code 0x80090011 means the key container was not found, and the fixes on this page start with the PIN data.

Does 0x80090011 mean my TPM is broken?

Usually not. In most cases the PIN data is damaged and a new PIN or an empty Ngc folder fixes it. The TPM becomes the suspect only when a new PIN fails every time, tpm.msc does not say The TPM is ready for use, or the error started after a BIOS change. Then check the TPM as in Fix 4 and contact the PC maker if it stays not ready.