Windows Hello PIN Not Working After an Update? How to Fix It

Since Microsoft’s August 2026 Windows update (KB5121003), a wave of users have reported the same frustrating loop: their Windows Hello PIN stops working after every reboot, forcing them to sign in with a password and re-enroll a new PIN each time. It is not new to this update, though. The Windows Hello PIN has broken this way after Windows updates for years, and the fixes below apply whether yours started this month or long before it.

Why the PIN Breaks in the First Place

Your Windows Hello PIN is not just a shorter password. It unlocks a cryptographic key stored in a hidden system folder called the NGC container (short for Next Generation Credentials), located at C:WindowsServiceProfilesLocalServiceAppDataLocalMicrosoftNgc. When Windows updates, a driver changes, or your account’s UPN (the internal username tied to your Microsoft or work account) shifts slightly, that container can end up out of sync with what Windows expects. The PIN itself is not wrong. The key it is supposed to unlock is corrupted or mismatched, so Windows rejects it and asks you to set it up again.

Fix 1: The Standard Reset

Try this first. It works for the large majority of cases and does not require any technical tools.

1. Press Windows key + I to open Settings, then go to Accounts > Sign-in options.
2. Under PIN (Windows Hello), click Remove, then restart your PC.
3. After restarting, go back to Accounts > Sign-in options and click Add under PIN to create a new one.

This is a destructive reset: it deletes the old key in the NGC container and provisions a brand new one tied to your new PIN. That is fine for almost everyone, since the PIN only unlocks local sign-in. It does not touch your files, your Microsoft account password, or OneDrive.

Fix 2: Delete the Hello Container Directly

If the standard reset option is greyed out or errors out, you can clear the container yourself.

1. Open PowerShell as your signed-in user (not as Administrator).
2. Run certutil -deletehellocontainer.
3. Sign out and back in, then set up a new PIN from Sign-in options as in Fix 1.

This does the same thing as the Settings-based removal, just at a lower level, which is why it can succeed when the graphical option is stuck.

Fix 3: Reset the NGC Folder Permissions

Occasionally the NGC folder itself has broken permissions rather than a bad key, usually after a botched update. This is the more advanced option, so use it only if Fixes 1 and 2 did not work.

1. Open Command Prompt as Administrator.
2. Run icacls C:WindowsServiceProfilesLocalServiceAppDataLocalMicrosoftNgc /T /Q /C /RESET to reset permissions on the folder.
3. Restart, then create a new PIN through Sign-in options.

What Not to Do

Do not manually delete files inside the Ngc folder while signed in, and do not run these commands from an account other than the one whose PIN is broken; certutil -deletehellocontainer only clears the container for the currently signed-in user. On a work or school PC managed with Windows Hello for Business, do not run a destructive reset without checking with IT first. Domain-managed devices often rely on a non-destructive PIN recovery service that preserves the underlying container and certificates; a destructive reset on those machines can require re-enrollment through your organization rather than a simple local fix, and in rare BitLocker-enabled setups it can prompt for a recovery key on next boot.

If You Are Seeing This After KB5121003 Specifically

Microsoft has not issued a specific acknowledgment of a Hello-related bug tied to KB5121003, the August 2026 security update also linked to game crashes on some systems. If your PIN issue started right after installing it and the fixes above resolve it, there is nothing more to do. If it keeps recurring after every single reboot even after a fresh PIN setup, that is a stronger sign of an unresolved update-related bug rather than one-time corruption, and it is worth watching for a follow-up patch before repeating the reset process indefinitely.

Common Misconceptions

Losing your PIN does not mean losing your account or your files. It is a local sign-in credential, not your Microsoft account password, and removing it does not affect anything stored in the cloud. It also is not a sign of malware or a security breach on its own; NGC container corruption is a known side effect of update and driver changes, not evidence of compromise. Finally, biometric Windows Hello (face or fingerprint) uses a separate enrollment from the PIN, so fixing your PIN will not automatically restore a broken fingerprint or face sign-in, and vice versa.

Conclusion

Most Windows Hello PIN failures come down to a corrupted NGC container, and the standard Settings reset clears it up in one restart for most people. Save the certutil and icacls commands for the cases where the simple route does not work, and treat a destructive reset carefully on any PC managed by an organization.

FAQ