If your Windows Hello PIN is not available, or Sign-in options says “This option is currently unavailable,” Windows is refusing to add, change, or use the PIN on this device for now; an organization policy, a sign-in setting, the account type, or damaged PIN enrollment is usually behind it. Preserve another supported way to sign in before changing anything, and record whether the message appears on the lock screen, under PIN in Settings, or after account verification. Confirm the correct Microsoft, local, or work account, restart and update Windows, then use the supported “I forgot my PIN” or “Set up” path; do not delete the NGC folder, clear the TPM, remove device management, or change policy blindly.

Key Takeaways

Keep a working password, security key, or administrator-assisted route before rebuilding a PIN.

A forgotten PIN, unavailable PIN, and failed fingerprint or face sign-in are different problems.

Verify network access and account credentials only when the recovery screen requires them.

Use Windows’ supported PIN reset or setup flow instead of deleting protected system data.

Managed-device policy and TPM errors belong to the administrator or device maker.

This article focuses on the PIN credential; for problems that span several devices or apps, start with the device and app troubleshooting guide. If a PIN works but fingerprint or face recognition does not, use the Windows Hello biometric guide. For a new computer that has not completed initial setup, use the Windows 11 setup checklist.

Which problem is Windows showing when the Windows Hello PIN is not available?

Write down the exact screen and message before restarting. The same phrase “PIN not working” can describe several different account states.

Symptom	First distinction
“Something happened and your PIN isn't available” on the sign-in screen	Preserve Sign-in options and note any recent update or security change
PIN is forgotten but the option still exists	Use the supported forgot-PIN flow for that account
PIN entry is missing from Sign-in options	Check Windows Hello requirements, account type, policy, and device state
Add or Set up button is grayed out	Look for organization messages, pending verification, or another required sign-in method
PIN setup accepts credentials but fails at the end	Record the error and check update, time, account, TPM, and management state
Fingerprint or face fails but PIN works	The PIN is available; troubleshoot the biometric sensor instead

On the lock screen, select Sign-in options and look for another method you already configured. A Microsoft account password may require network access if Windows needs online verification, while a local account password is validated differently. Do not repeatedly guess credentials until the account is locked.

Microsoft states that a Windows Hello PIN never leaves the device, so it is a different credential from the Microsoft account password.［4］ Resetting one does not automatically mean the other has changed. Confirm which credential the screen requests before entering it.

If the computer contains irreplaceable local data, avoid experiments that could trigger BitLocker recovery or remove account keys. Locate the BitLocker recovery key through the approved personal or organization process before firmware or TPM work.

What does “This option is currently unavailable” mean for a Windows Hello PIN?

The message appears under PIN (Windows Hello) in Settings > Accounts > Sign-in options when Windows will not let you add, change, or remove the PIN right now. It is a status, not an error code, so read the line beneath it before changing anything.

What appears with it	Where to look	Next step
“Some settings are managed by your organization” or “This setting is managed by your organization”	Work, school, or policy configuration	Send the full text to the administrator; do not edit Group Policy or remove the work account
Remove is grayed out, but Change PIN works	Additional settings on the same page	Check whether “Only allow Windows Hello sign-in for Microsoft accounts on this device” is on［3］
Add, Change, and I forgot my PIN are all unavailable	Account state, updates, or PIN enrollment	Sign in with your password, check for updates, then retry the supported setup flow［1］［2］

Microsoft describes that Additional settings option as turning off password use for the Microsoft account on the device.［3］ Before switching it off to remove the PIN, confirm that you know the account password, or you may be left without a working sign-in method.

Can you still sign in by another supported method?

Use an already configured password or security key through Sign-in options. Do not add a new remote-control tool, create an unknown recovery account, or reveal the password to a helper. If the device is managed, the help desk may provide an approved recovery process.

After signing in, confirm that the expected profile loaded. Check the account name and whether Settings shows a Microsoft account, local account, or work or school connection. Do not convert account types merely to make the PIN button appear; conversion changes recovery, encryption, synchronization, and policy behavior.

If no alternative method appears, select “I forgot my PIN” only when that supported link is offered. Microsoft distinguishes resetting from the sign-in screen and changing the PIN after sign-in, and notes that the forgot-PIN link is offered only for Microsoft accounts; with a local account, sign in with the password and change the PIN in Settings.［2］ The flow may ask you to verify the account, and it may require a working network connection.

Connect only to a trusted network. If Wi-Fi controls themselves are missing, use the Windows missing Wi-Fi guide after preserving the current sign-in screen and any available Ethernet option. Do not reset the router or network stack merely because online account verification failed once.

When a local account password is forgotten and no approved recovery option exists, stop and use Microsoft’s supported account-recovery guidance or the organization’s process. Bypassing the credential store is not PIN troubleshooting and can destroy access to encrypted data.

What should you check after signing in?

Restart Windows normally and return to Settings > Accounts > Sign-in options. Microsoft's Windows Hello troubleshooting page suggests checking for system updates when Windows asks for a PIN again, and signing out and back in before retrying PIN creation.［1］ Install stable updates, then restart when prompted before testing PIN setup again.

Confirm date, time, and time zone are correct, especially if account verification or organization sign-in reports a certificate or authentication error. Use automatic time through the supported Settings control when appropriate; do not disable certificate checks or weaken account security.

Look for pending account-verification banners. A Microsoft account may need a current password or second factor. A work account may require the organization’s network, compliance state, or multifactor process. Complete only prompts you recognize on authentic Windows or organization pages.

If the PIN entry still shows “This option is currently unavailable,” expand it and record the full reason, then match it against the table above. A gray button without its adjacent explanation loses important evidence.

If the issue began after a BIOS, motherboard, TPM, account, password, or security-policy change, record that event. Windows Hello keys are device-bound, so a legitimate hardware or security change may require supported reprovisioning. It does not justify clearing the TPM without understanding BitLocker and organization impact.

Can't set up Windows Hello PIN? Reset or rebuild it safely

If you are signed in and know the current PIN, use Settings > Accounts > Sign-in options > PIN (Windows Hello) > Change PIN. If you do not know it, choose “I forgot my PIN” and complete identity verification. Microsoft’s PIN guidance documents both paths.［2］

If the sign-in screen says the PIN is unavailable and offers “Set up my PIN,” use that visible Windows flow. Verify that the account shown is yours and that the network is trusted. Finish the prompt once, then test a lock and unlock before restarting multiple times.

A PIN should not be reused as the Microsoft account password. Follow the length and complexity rules displayed by Windows or your organization. Do not share it with support staff or store it in a public note.

If setup fails, capture the exact error code, time, Windows build, account type, and whether password sign-in still works. Check Event Viewer only if you can identify the relevant Windows Hello or account event; do not clear logs before support sees them.

Avoid internet recipes that take ownership of and delete the protected NGC directory. They can damage other users’ PIN enrollment, conflict with managed policy, and hide the original cause. Also avoid registry edits and copied Group Policy changes unless the administrator or Microsoft documentation for the exact edition and scenario directs them.

Do not clear the TPM as a generic PIN reset. The TPM can protect BitLocker and other device-bound credentials. Clearing it without recovery keys and an approved plan can make encrypted data or enterprise access unavailable.

Windows Hello PIN option missing? The account or organization may control it

Microsoft’s Sign-in options documentation notes that available methods vary with device configuration and account.［3］ A personal Microsoft account, local account, Microsoft Entra work account, and domain account do not necessarily expose identical Windows Hello controls.

On a managed computer, security baselines may require Windows Hello for Business, minimum PIN rules, multifactor registration, device compliance, or administrator provisioning. They may also intentionally hide a consumer recovery path. Do not disconnect Access work or school, remove certificates, unenroll the device, or edit Local Group Policy to escape those controls.

Send the administrator:

the exact error message and code;
device and Windows version, without posting serial numbers publicly;
whether password or security-key sign-in works;
whether the PIN option is absent, grayed, or failing during setup;
the time of the last successful PIN sign-in;
recent password, account, hardware, firmware, or management changes.

If you are the authorized administrator, use the organization’s Windows Hello for Business deployment and recovery documentation, current policy reports, and identity logs. Do not apply consumer fixes to an enterprise profile without checking the real policy owner.

Parental or shared-family settings are not the same as enterprise management. Preserve each user’s account boundary. Rebuilding one user’s PIN should not require deleting another user’s credential files.

When do TPM, firmware, or repair become relevant?

Use Windows Security or the PC maker’s supported diagnostics to check whether the security processor reports an error. Record the message. Do not initialize, reset, or clear it just to see whether the PIN returns.

Install BIOS, UEFI, chipset, and security-device updates only from the exact computer manufacturer, with stable power and the BitLocker recovery key ready. If the issue began immediately after a firmware update, check that manufacturer’s notices rather than downgrading with an unofficial image.

Administrator or manufacturer help is appropriate when:

password sign-in works but supported PIN reset repeatedly fails with the same code;
the security processor reports a persistent hardware or attestation error;
the option disappeared after motherboard, TPM, or account repair;
BitLocker recovery appears unexpectedly;
organization policy cannot be read or applied;
no supported sign-in or recovery method remains.

If the device was repaired, confirm whether the motherboard or TPM was replaced. Device-bound Windows Hello credentials may need to be enrolled again after such a change. The repairer should not need your Microsoft account password; use an approved service workflow.

Before any reset or reinstall of Windows, verify a complete backup and confirm that encrypted files can be recovered. A Windows reinstall is not a routine PIN repair and may remove applications, settings, local files, and recovery state.

Summary

Record whether the PIN is forgotten, unavailable, missing, grayed out, or failing during setup.
Preserve a supported password, security key, or administrator recovery route.
Restart, update, confirm the account type, and read the full Sign-in options explanation.
Use Change PIN, I forgot my PIN, or Set up my PIN through Windows’ supported interface.
Never delete NGC, clear the TPM, remove management, or edit policy blindly.

FAQ

Is my Windows Hello PIN the same as my Microsoft password?

No. The PIN is tied to the device, while the Microsoft account password belongs to the account. Read the prompt carefully so you enter or reset the intended credential.

What should I do when Windows says my PIN is not available?

Open Sign-in options, preserve another working method, record the full message, then use “Set up my PIN” or “I forgot my PIN” when Windows offers it. Restart and update after you can sign in.

Can I sign in with my password instead?

Yes, if password sign-in is enabled and you know the correct credential. Choose it through Sign-in options rather than typing the password into a PIN field.

Why is the Add PIN button grayed out?

The adjacent message may identify pending account verification, an unavailable Windows Hello requirement, or organization policy. Record it and confirm the account type before changing anything.

Should I delete the NGC folder to fix the PIN?

No. Taking ownership and deleting protected credential data can affect other users, managed policy, and recovery. Use supported PIN reset or administrator guidance.

Should I clear the TPM?

Not as a generic troubleshooting step. The TPM may protect BitLocker and other credentials; clearing it without recovery keys and a specific approved plan can lock you out of encrypted data.

Why did the PIN stop working after a motherboard repair?

Windows Hello credentials are device-bound, and a motherboard or security-processor replacement can require enrollment again. Confirm the repair details and use supported reprovisioning.

When should I contact my work or school administrator?

Contact them when the device is managed, Windows says settings are controlled by the organization, policy or compliance fails, or the approved recovery method is unavailable. Do not remove management yourself.

Sources

Microsoft Support - Windows Hello common issues and troubleshooting tips — https://support.microsoft.com/en-us/windows/windows-hello-common-issues-and-troubleshooting-tips-bf68539e-e95e-48b6-a6cb-455649db3887
Microsoft Support - Change or reset your PIN in Windows — https://support.microsoft.com/en-us/windows/security/identity-signin/change-or-reset-your-pin-in-windows
Microsoft Support - Sign-in options in Windows — https://support.microsoft.com/en-us/accounts-billing/security/sign-in-options-in-windows
Microsoft Learn - Windows Hello for Business overview — https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/

Sources checked 4 October 2026.

Windows Hello PIN Is Not Available: What to Check