How to Fix Windows Sign-In Errors — PIN, Password, and Windows Hello Issues

Applies to: Windows 10, Windows 11, Microsoft Entra ID (Azure AD), Active Directory domain-joined PCs
Article Type: Troubleshooting
Last Updated: 2026-06-17

Summary

This article covers what to do when you cannot sign in to your Windows PC — including PIN failures, "Trusted Platform Module has malfunctioned" errors, Windows Hello not recognizing your face or fingerprint, and passwords being rejected. Most of these issues can be resolved from the lock screen without admin access.

Prerequisites

• Physical access to the Windows PC you are trying to sign in to.
• Your Microsoft account password or domain password (as a fallback if your PIN fails).

Instructions

1. Try All Available Sign-In Methods

Windows supports multiple sign-in methods — PIN, password, fingerprint, facial recognition, and security key. If one method fails, another may still work.

1. On the Windows lock screen, look for Sign-in options below the PIN or password field. It may appear as a row of small icons.
2. Click Sign-in options to see all available methods.
3. Try each available option:
   • Key icon — Password
   • Keypad icon — PIN
   • Fingerprint icon — Fingerprint
   • Camera icon — Facial recognition
4. If you can sign in with any method, you are back in and can fix the broken method from within Windows (see Steps 3–5).
5. Before assuming the password is wrong, check the Num Lock light on your keyboard. With Num Lock off, the number pad sends arrows and Home/End instead of digits, so any digits in your password never reach the box — and the failure looks identical to a wrong password. Type the digits from the number row along the top of the keyboard instead, then fix it permanently with How to Turn On Num Lock at Startup on Windows.
6. If no sign-in method works, continue to Step 2.

2. Check Your Network Connection

If your organization recently changed your password — or if you changed it on another device — your Windows PC needs a network connection to learn about the new password. Without it, the PC only knows your old password.

1. On the lock screen, look at the bottom-right corner for the Network icon (Wi-Fi or Ethernet).
2. Click the Network icon and connect to your Wi-Fi network if you are not already connected.
3. If you are on a wired connection, confirm the Ethernet cable is plugged in.
4. After connecting, try signing in again with your new password.
5. If the lock screen does not show a network icon, or you cannot connect to the network, try your old password — Windows may still accept it if the password change has not synced yet.

3. Fix "Something Happened and Your PIN Isn't Available"

This error means the PIN container (called NGC) on your device is corrupted. You need to delete it and create a new PIN.

If you can sign in with your password instead:

1. Sign in with your password (click Sign-in options on the lock screen and select the key icon).
2. Open Settings > Accounts > Sign-in options.
3. Under PIN (Windows Hello), click Remove.
4. Confirm your account password when prompted.
5. Click Add or Set up to create a new PIN.
6. Enter and confirm your new PIN. Your PIN sign-in is now restored.

If you cannot sign in at all:

1. On the lock screen, click I forgot my PIN (below the PIN field).
2. Windows will ask you to verify your identity — follow the prompts to verify via your Microsoft account email, phone, or authenticator app.
3. After verification, set a new PIN.
4. If you are on a domain-joined PC and do not see "I forgot my PIN," ask IT to reset the PIN on your account. Tell them you are locked out at the lock screen and that the self-service reset link is not offered on your device.

4. Fix "Trusted Platform Module Has Malfunctioned"

The TPM is a hardware security chip on your PC that stores your PIN and Windows Hello credentials. When it malfunctions, PIN and biometric sign-in stop working.

If you can sign in with your password:

1. Sign in with your password (click Sign-in options and select the key icon).
2. Open Settings > Accounts > Sign-in options.
3. Under PIN (Windows Hello), click Remove. This clears the corrupted TPM-stored PIN.
4. Restart your PC.
5. After restart, go back to Settings > Accounts > Sign-in options and click Set up under PIN to create a new PIN. This re-establishes the TPM relationship.

If you cannot sign in at all:

1. Try your password first (Step 1).
2. If your password also fails, you may need to boot into Safe Mode: hold Shift while clicking Restart on the lock screen power menu. Select Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 or F4 for Safe Mode.
3. In Safe Mode, sign in with your local or domain password. From here, remove and re-create your PIN using the steps above.
4. If Safe Mode also fails, ask IT to clear the TPM and re-enroll the device. Tell them you are seeing Trusted Platform Module has malfunctioned, and that removing and re-creating the PIN in Safe Mode did not survive a restart.

5. Fix Windows Hello Fingerprint or Face Not Recognized

If Windows Hello cannot recognize your fingerprint or face, the biometric data stored on your device may be corrupted, or the sensor may have a physical issue.

1. Sign in using your PIN or password instead (click Sign-in options on the lock screen).
2. Open Settings > Accounts > Sign-in options.
3. Under Fingerprint recognition (Windows Hello) or Facial recognition (Windows Hello), click Remove to delete the existing biometric data.
4. Click Set up to re-enroll your fingerprint or face.
5. For fingerprint issues: clean the fingerprint sensor with a dry, lint-free cloth. Wet or dirty fingers cause consistent failures.
6. For facial recognition issues: ensure the infrared (IR) camera is not blocked or covered. Check that the room has adequate lighting.
7. If the Set up button is greyed out or says Windows Hello isn't available on this device, the biometric hardware or its driver may not be working. Open Device Manager (press Win + X and select Device Manager), expand Biometric devices, right-click your sensor, and select Update driver or Uninstall device (then restart to let Windows reinstall it).

6. Fix Password Rejected After a Password Change

If you recently changed your password on another device, through a web portal, or through a mobile app, your PC may still expect the old password.

1. On the lock screen, try your old password first. Windows sometimes accepts the old password if the new one has not synced yet.
2. If the old password works, sign in and then lock your PC (Win + L). Sign in again with your new password — this forces the PC to learn the new password.
3. If neither old nor new password works, check your network connection (Step 2). Domain-joined and Entra-joined PCs require a network connection to validate a new password.
4. If you are using a Microsoft account (personal), go to https://account.live.com/password/reset on another device to reset your password, then try the new password on the lock screen.

7. Use the "I Forgot My PIN" Lock Screen Reset

If your PIN does not work and you cannot remember your password, use the built-in reset flow directly from the lock screen.

1. On the lock screen, click I forgot my PIN below the PIN entry field.
2. Windows will ask you to authenticate with your Microsoft account or work account — this may involve entering your email, receiving a verification code, or approving a push notification on the Authenticator app.
3. After verification, you will be prompted to create a new PIN.
4. Enter and confirm your new PIN.
5. If you do not see "I forgot my PIN," your PC is likely domain-joined with PIN reset disabled by policy. Ask IT which route is open to you instead — a password reset you can run yourself from another device, or a PIN reset they perform on your account.

8. Fix Sign-In Issues After a Windows Update

Windows updates occasionally break the relationship between the TPM and your stored credentials, causing PIN and Hello failures on the next sign-in.

1. Try signing in with your password instead of your PIN (click Sign-in options on the lock screen).
2. If your password works, check for additional pending updates: go to Settings > Windows Update and click Check for updates. Install any available updates and restart — Microsoft sometimes releases a follow-up fix.
3. If the issue started immediately after an update, remove and re-create your PIN (Step 3) to re-establish the TPM relationship.
4. If you cannot sign in at all and the update caused the issue, try rolling back the update: hold Shift while clicking Restart on the lock screen power menu. Select Troubleshoot > Advanced options > Uninstall updates and choose the most recent quality or feature update.

9. Fix "The User Profile Service Failed the Sign-In"

This error means your Windows user profile is corrupted. Windows cannot load your desktop, files, or settings.

1. Restart your PC and try signing in again — this error is sometimes temporary.
2. If the error persists, repairing the profile needs admin access. Ask IT to rebuild your Windows user profile, and quote the error exactly — The User Profile Service failed the sign-in — along with your PC's name.
3. If you have a second admin account on the PC, sign in with that account. IT can then repair or recreate your user profile.
4. Do not attempt to edit the Windows Registry to fix this unless instructed by IT — incorrect registry changes can make the problem worse.

10. When to Contact IT

Every sign-in failure looks the same from the helpdesk's side, so identify yours in the ticket: the error text from the lock screen word for word, which methods you tried (PIN, password, fingerprint, face), and whether this PC has been off the company network for a while — that is what leaves cached credentials out of date after a password change.

Contact your IT helpdesk if:

• You cannot sign in with any method — PIN, password, fingerprint, or face — and the lock screen reset flow is not available or fails.
• You see a BitLocker recovery key screen. This means Windows cannot verify the boot integrity of your device. Your IT department can provide the recovery key.
• Your account may be locked out by a security policy — too many failed sign-in attempts can trigger a timed lockout that only an admin can clear.
• You need to reset your domain password but do not have Self-Service Password Reset (SSPR) configured — IT needs to reset it for you.
• The TPM error persists after removing and re-creating your PIN — the TPM hardware may need to be cleared or the device re-enrolled in your organization's management system.
• Your device was recently re-imaged, replaced, or repaired, and sign-in no longer works — the device may need to be re-registered with Entra ID or Active Directory.

Troubleshooting

DANGER

Always try your password as a fallback when your PIN or Windows Hello fails — use the Sign-in options link on the lock screen to switch methods. If your password also fails, check your network connection first (Step 2) before escalating to IT.

Symptom / Error	Potential Cause	Solution
Something happened and your PIN isn't available	Corrupted NGC (PIN) container	Remove and re-create PIN (Step 3).
Trusted Platform Module has malfunctioned	TPM/PIN relationship broken	Sign in with password, remove PIN, restart, re-create PIN (Step 4).
Password worked yesterday, rejected today	Password changed on another device	Connect to network and try new password (Step 2).
Password with digits rejected, no error code	Num Lock off, number pad sending arrows	Type the digits from the number row, then see How to Turn On Num Lock at Startup on Windows.
Windows Hello isn't available on this device	Hardware not supported or driver missing	Check Device Manager for biometric device driver (Step 5).
The sign-in method you're trying to use isn't allowed	Group Policy restriction	Ask IT which sign-in methods are permitted on this device, and to enable one you can actually set up.
Sign-in fails only after a Windows update	Update broke TPM relationship	Remove and re-create PIN (Step 3), or roll back the update (Step 8).
The User Profile Service failed the sign-in	Corrupted user profile	Restart; if persistent, contact IT (Step 9).

Related Articles

• How to Set Up a Windows Hello PIN
• How to Set Up Windows Hello Fingerprint
• How to Set Up Windows Hello Facial Recognition
• How to Change Your Windows Password on a Domain-Joined Computer
• How to Set Up Self-Service Password Reset (SSPR)
• Understanding Windows Sign-In Methods — Passwords, PINs, and Biometrics
• How to Turn On Num Lock at Startup on Windows

Did this solve your problem?