If Windows Hello breaks after every restart, fix it in this order: re-enroll the sign-in credential, repair the TPM/device binding, then clear any policy or PIN conflicts. If you skip the loop, fast sign-in can disappear and you may end up on passwords or recovery codes. This guide shows how to spot the failing layer and the exact Windows 10/11 steps to restore persistence.
What the restart problem means
First, confirm that your password still signs in before you change anything else. If the password works but Hello does not survive a reboot, the failure is usually in one of three places: the PIN credential, the biometric device binding, or a policy setting that reloads after startup.
If your laptop accepts face sign-in right after setup, then asks for a PIN or password again after the next restart, the camera is probably fine. The stored credential, or a policy that will not stick, is the real problem.
Windows Hello on Windows 10 and 11 uses face, fingerprint, or PIN, and it binds those sign-in methods to the device and local credentials. That is why a fix that works once can fail again after reboot if the underlying store never gets rebuilt correctly. (Microsoft Support)
Likely causes
Most often, repeated post-restart failures come from a broken Windows Hello PIN credential stored in the local NGC container. Less often, a biometric device driver changes after Windows Update, or a work or school policy for Windows Hello for Business reverts settings at sign-in. TPM changes can also break provisioning after a reboot.
- NGC credential corruption: PIN or Hello state keeps returning to the same broken setup.
- Driver regression: the camera or fingerprint reader vanishes or fails after an update.
- Policy block: a work or school account overrides consumer Windows Hello settings.
- TPM problem: hardware-backed credential storage no longer matches the provisioned Hello data.
Windows Hello PIN resets
If the PIN keeps reverting, rebuild the PIN first. The Windows Hello PIN is the main fallback sign-in method, and if it is damaged, face and fingerprint sign-in can fail with it. If removal is blocked, sign in with your password and then recreate it from scratch.
- Open Settings > Accounts > Sign-in options.
- Confirm with your password if Windows asks.
- Restart the PC once.
- Return to Sign-in options and create a new PIN.
If the same PIN issue returns after the next reboot, repair the credential store. The NGC path is: (Microsoft Learn)
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC
- Sign in with a password or another working account that has administrator rights.
- Open Command Prompt as administrator.
- Run: takeown /f "
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC"/r /d y - Run: icacls "
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC"/grant administrators:F /t - Delete the contents of the NGC folder, not the folder path itself.
- Restart, then create a fresh PIN in Settings > Accounts > Sign-in options.
Why face or fingerprint disappears?
If the face or fingerprint option disappears after reboot, the device binding is the likely problem. The reader or camera may still work at a hardware level, but Windows may not be loading the biometric device driver correctly, or the enrolled template no longer matches the device state. Re-enroll only after the device appears stable.
- Open Settings > Accounts > Sign-in options.
- Check whether Face recognition (Windows Hello) or Fingerprint recognition (Windows Hello) is still listed.
- Open Device Manager, expand Cameras or Biometric devices, and confirm the device is present.
- Right-click the device and choose Update driver. If the issue started after a recent change, use Roll Back Driver if available.
- If that does not help, choose Uninstall device, then restart and let Windows reinstall it.
- Return to Sign-in options and set up face or fingerprint again.
Check Settings > Windows Update > Update history if the problem started after a patch. A driver or security update is often the clue that explains why biometric sign-in vanished after reboot.
Why Hello becomes unavailable after reboot?
If Hello shows as unavailable after startup, check policy first on a work or school device. Windows Hello for Business can override local settings, and organizational rules may block PIN or biometric sign-in even when the consumer UI still looks normal. TPM issues can also stop provisioning from loading again.
- Open Settings > Accounts > Access work or school.
- Check whether the device is joined to an organization or managed by policy.
- Open Settings > Accounts > Sign-in options and confirm whether Hello options are missing or greyed out.
- Open Windows Security > Device security and check whether a Security processor status appears.
- Restart and enter firmware settings to verify TPM is enabled there, not just visible in Windows.
- If the device is managed, ask IT to review Hello for Business policy before you keep changing local settings.
Picture a company laptop that works with fingerprint sign-in on Monday, then loses the option after a managed update on Tuesday. That pattern points to policy or device provisioning, not a damaged finger reader.
Windows hello reset checklist
Use this table to match the restart pattern to the right fix. Do not start with driver changes if the PIN itself is resetting; that usually wastes time and can create a second problem.
| Symptom | Likely cause | Fastest test | Exact fix |
|---|---|---|---|
| PIN resets after every reboot | NGC credential corruption | Remove the PIN, restart, then see whether the same PIN state returns | Recreate the PIN in Settings > Accounts > Sign-in options; if it loops again, rebuild C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC |
| Face or fingerprint disappears | Biometric device driver or template binding | Check whether the device still appears in Device Manager | Update, roll back, or uninstall the driver; then re-enroll in Sign-in options |
| Hello becomes unavailable | Policy block or TPM provisioning issue | Check Access work or school and Device security | Review Windows Hello for Business policy, verify TPM in firmware, and re-provision if allowed |
| Hello works once then breaks after reboot | Persistence failure in credential store or update regression | Check Update history for a recent driver or security change | Rebuild the PIN, repair the NGC store, then reinstall the biometric driver if the issue remains |
Still not working?
If the issue survives a clean PIN rebuild and a clean biometric re-enrollment, move to the next layer: profile repair, system file repair, or a full Hello re-provision. Start with sfc /scannow in an elevated Command Prompt, then DISM /Online /Cleanup-Image /RestoreHealth if Windows files look damaged.
- Sign in with a password.
- Open Command Prompt as administrator.
- Run
sfc /scannow. - If SFC reports unrepaired files, run
DISM /Online /Cleanup-Image /RestoreHealth,then run SFC again. - If this is a managed device, ask IT to check Hello for Business policy and TPM provisioning.
- If firmware TPM changes were made recently, stop and verify they match your organization’s settings before clearing anything.
Do not clear TPM unless you have a recovery plan and a sign-in path that still works. On a work or school PC, that step can force a full re-enrollment and may require help from IT.
A common first-timer mistake is to keep changing the fingerprint reader settings while the PIN store is the real failure. Fix the PIN layer first, because Hello often falls back to it after restart.
Prevention: after Windows Update installs a driver or security patch, open Settings > Accounts > Sign-in options once and confirm the PIN and biometric options still appear before you rely on them again.
Frequently asked questions
Why does Windows Hello reset after restart?
That usually means the credential did not persist across reboot. Start with Settings > Accounts > Sign-in options, remove the PIN, reboot once, and create a new one. If biometrics fail too, check the device driver and then the NGC store.
How do I stop Windows Hello from resetting after I reboot?
Fix the layer that is not sticking. Rebuild the PIN first, then re-enroll face or fingerprint, and finally check for policy or TPM issues. If the same failure returns after reboot, rebuild the NGC contents at C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC.
What happens after Windows reset to Windows Hello?
After a Windows reset, Hello often needs to be set up again because local credentials and device bindings can be removed or replaced. Open Settings > Accounts > Sign-in options, create a new PIN, then add face or fingerprint again if the hardware still appears.
How do I reset Windows Hello password or PIN?
There is no separate Hello password to reset; the common fix is the PIN.
Why does Windows Hello keep asking for my PIN after restart?
That usually means the biometric path is not trusted on boot, so Windows falls back to the PIN. Recheck the biometric device in Device Manager, confirm the PIN still exists in Sign-in options, and review Update history for a driver or security change.
How do I restart the Windows Hello service?
For face or fingerprint troubleshooting, restart Windows Biometric Service in services.msc. Open Services, find the entry, choose Restart, then test face or fingerprint again. That step does not repair a broken PIN store, so use it only for biometric sign-in issues.