Windows Hello “This option is currently unavailable” error

Windows Hello works well right up until it doesn’t. A user opens Settings > Accounts > Sign-in options, and the facial recognition and fingerprint options are greyed out with a single unhelpful line: “This option is currently unavailable.” There’s no error code and no indication of what changed, just a user who can no longer sign in the way they have for the last six months.

The cause can be anything from a Windows update to a corrupted credential store to a Group Policy setting somebody changed three weeks ago. In my case it turned out to be a misconfigured Group Policy setting, which is why that’s now the first thing I check rather than the last. This article covers the fixes that work, in the order I’d actually try them.

Which fix should you try first?

Someone asked me this in the comments years ago, and the original version of this article never answered it properly. So here’s the order I’d try them in:

1. Check Group Policy if the device is domain joined or managed. It’s the most common cause in a corporate environment, and the quickest to rule out.
2. Delete the Hello container if the device is standalone, or if Group Policy looks correct. This fixes the majority of credential-corruption cases.
3. Reset the biometric database if the PIN works but facial recognition or fingerprint doesn’t.
4. Reinstall the camera or fingerprint drivers if the hardware isn’t appearing correctly in Device Manager.
5. Turn off Fast Startup if the problem keeps coming back after a shutdown.

If you’re troubleshooting a single machine, try step 2 first. If several machines are affected at once, start with step 1, because a policy change is far more likely than several devices corrupting at the same time. Judging by the comments on this article over the years, Group Policy is the fix that resolves it for most people.

1. Check the Group Policy settings

If the device is domain joined or managed, this is where I’d start. A policy change can disable biometrics without any symptom other than the greyed-out option.

Opening the Group Policy Editor

Several readers have asked how to get to these settings. Press Win + R, type gpedit.msc and press Enter. If Windows says it can’t find gpedit.msc, you’re running Windows Home, which doesn’t include the Group Policy Editor. You’ll need to apply the equivalent settings through the registry, or move the device to a Pro licence.

If the machine is domain joined, remember that a local policy change can be overwritten at the next policy refresh. In that case the change belongs in the domain GPO, not in local policy.

The settings to check

Microsoft documents the full set in Windows Hello for Business policy settings. These are the ones that matter for this error:

Two settings worth understanding

Use Windows Hello for Business changes the whole enrolment model. Setting it to Enabled switches the device to certificate or key-based Windows Hello for Business, rather than the simpler convenience PIN and biometric sign-in. If you only want biometric sign-in working and aren’t deploying Hello for Business properly, leave it Not configured.

There’s a catch if the policy was enabled once and later switched off. As a Microsoft Directory Services engineer explains, the user then loses the ability to remove the PIN themselves, because the Remove button relies on the provisioning process that the policy has now disabled. The fix is deleting the Hello container, covered in the next section.

Enhanced anti-spoofing needs camera hardware that supports it. On hardware that doesn’t, enabling it can make facial recognition unavailable rather than more secure. Check whether the device’s IR camera supports the feature before enabling it. If it doesn’t, setting the policy to Disabled is what restores facial recognition.

Confirm what’s actually applying

Run this from an elevated command prompt, open the resulting file, and look at the applied policies rather than trusting what you think the GPO says:

cmd

gpresult /h C:\temp\gpresult.html

A policy from a different OU may be winning.

2. Delete the Hello container

This is the fix for a corrupted credential store, and it resolves most single-device cases.

The supported way

Run this as the affected user, not as an administrator, then sign out and back in:

cmd

certutil.exe -deleteHelloContainer

This removes the user’s Hello credentials cleanly. It’s considerably safer than working directly with the folder, and it’s what I’d use first on any modern build. Microsoft documents it in the Windows Hello for Business FAQ.

Two things to know before you run it. It removes the container for the user running the command, not for the whole machine, so on a shared device each user has to run it under their own account. It also removes any passkeys stored in the container. If the user has saved passkeys for websites or applications, those go too and will need setting up again, so mention it to them first.

Rename the Ngc folder manually

If certutil doesn’t resolve it, you can deal with the Ngc folder directly. This is the original fix and it still works.

First, make the folder visible. Open Control Panel > File Explorer Options, and on the View tab under Advanced settings, select Show hidden files, folders and drives, then untick Hide protected operating system files. Now browse to:

text

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft

Then take ownership of the Ngc folder:

1. Right-click the Ngc folder, choose Properties, go to the Security tab and click Advanced.
2. At the top, next to Owner, click Change.
3. Make sure the From this location field shows the computer name, and click Locations to change it if it doesn’t.
4. Under Enter the object name to select, type Administrators, click Check Names, then OK.
5. Tick Replace owner on subcontainers and objects, then click Apply and OK.

Here’s the practical point that took me a while to work out. Some of the folder’s contents can’t be deleted regardless of ownership. Rather than fighting it, rename the folder from Ngc to Old_Ngc, then create a new empty folder named Ngc alongside it. Reboot, and the sign-in options should let you create a PIN and enrol a facial profile again. That rename is the step most guides leave out, and it’s why this fix fails for people following instructions elsewhere.

Be aware of what this removes. Renaming the Ngc folder clears the Hello credentials for every user on that device, and each of them will need to set up their PIN and biometrics again. On an Entra-joined device using Hello for Business, they’ll also need connectivity to Entra ID to re-enrol, so don’t do this to a remote user who’s about to get on a plane.

3. Reset the biometric database

If the PIN works but facial recognition or fingerprint doesn’t, the biometric database is a more likely culprit than the credential store.

Start by stopping the service. Press Win + R, type services.msc and press Enter, then find Windows Biometric Service, right-click it and choose Stop.

Next, back up and clear the database. In File Explorer, go to C:\Windows\System32\WinBioDatabase, copy the folder’s contents somewhere safe, such as a folder called WinBioBackup, and then delete the files from the original folder. Don’t skip the backup. If the reset doesn’t help, you can put the files back and rule this cause out, rather than having destroyed everyone’s enrolments for nothing.

Finally, go back to Services, right-click Windows Biometric Service and choose Start, then go to Settings > Accounts > Sign-in options and enrol again. Every user on the device has to re-enrol, so on a shared machine that’s a conversation to have before you start rather than after.

4. Reinstall the camera or fingerprint drivers

If Device Manager shows the hardware with a warning, or the camera isn’t listed at all, reinstall the driver. On a Surface device:

1. Open Device Manager and expand System devices.
2. Find Microsoft IR Camera Front and uninstall it. When prompted, don’t tick the option to delete the driver software.
3. Do the same for Surface Camera Windows Hello.
4. Restart the device twice.

The two restarts matter on Surface hardware. The first lets Windows redetect the devices, and the second lets the biometric service pick them up properly. Other manufacturers use different device names, but the principle is the same: look under System devices, Biometric devices and Cameras.

Also check that the camera isn’t disabled at a lower level. Camera access should be enabled under Settings > Privacy & security > Camera, and Device Manager shouldn’t show any disabled devices. Some business laptops also let you disable the IR camera or fingerprint reader in the BIOS or UEFI, and that catches people out when a firmware update resets the defaults.

5. Turn off Fast Startup

Fast Startup means the machine never fully shuts down, and that can leave the biometric stack in a state it doesn’t recover from. If the problem keeps returning after a shutdown but not after a restart, this is the likely cause.

To turn it off on one machine, go to Control Panel > Power Options > Choose what the power buttons do > Change settings that are currently unavailable, then untick Turn on fast startup.

To turn it off centrally, don’t rely on the “Require use of fast startup” policy. That policy can only force Fast Startup on, and setting it to Disabled just hands control back to the local setting. Instead, deploy a registry change with Group Policy Preferences that sets HiberbootEnabled to 0 under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power. Alternatively, run this from an elevated prompt, which disables hibernation and Fast Startup together:

cmd

powercfg /hibernate off

Windows 11 and Entra-joined devices

The original version of this article was written for domain-joined Windows 10 devices, which reached end of support on 14 October 2025. A few things have changed since.

The sign-in options are now under Settings > Accounts > Sign-in options, with Facial recognition, Fingerprint recognition and PIN as separate entries. The greyed-out symptom looks the same.

On an Entra-joined or Intune-managed device, Group Policy may not be the control at all. The equivalent settings come from Intune configuration, which Microsoft documents in its identity protection settings for Windows. There’s also a tenant-wide Hello for Business setting in Intune. According to Microsoft Q&A, disabling that tenant-wide setting only stops enrolment during new device provisioning. It doesn’t remove existing PINs, which still need the container deleting.

To see which applies, go to Settings > Accounts > Access work or school. If the device is Entra joined rather than domain joined, look at Intune before you look at Group Policy.

Hello for Business enrolment can also fail for reasons unrelated to this error, including certificate problems, missing licences and Conditional Access policies blocking registration. If certutil and re-enrolment then fail with a specific error code, that’s a different problem from the greyed-out option this article covers.

If none of these work

Before rebuilding the machine, check a few more things:

• TPM. Biometric sign-in depends on it. Run tpm.msc and confirm the TPM is present, ready for use and not in a reduced-functionality state. A TPM that needs clearing produces all sorts of odd authentication behaviour.
• Account type. Convenience PIN sign-in behaves differently for local accounts, Microsoft accounts and work accounts.
• Windows updates. Check in both directions. A recent update can break biometrics, and a missing one can mean a fix never arrived.
• System file corruption. Rule it out with sfc /scannow, and if that doesn’t help, DISM /Online /Cleanup-Image /RestoreHealth.
• Event Viewer. Open eventvwr.msc and go to Applications and Services Logs > Microsoft > Windows, then check the Biometrics, User Device Registration and HelloForBusiness logs. They’ll usually name the actual failure rather than leaving you with a greyed-out toggle.

The two usual causes

Most of the time it’s one of two things. On a managed device, Group Policy or Intune configuration is disabling biometrics, and no amount of deleting folders will fix a policy that’s actively turning the feature off. On a standalone device, it’s a corrupted Hello container, and certutil -deleteHelloContainer followed by signing out and back in resolves it. Everything else in this article is what you work through when neither of those applies.

Windows Hello troubleshooting checklist

1. Check whether the device is domain joined, Entra joined or standalone under Settings > Accounts > Access work or school.
2. On a managed device, run gpresult /h or check Intune, and confirm biometrics and convenience PIN sign-in are allowed.
3. Check whether the Use Windows Hello for Business policy is enabled when you only need convenience sign-in, or was enabled once and later switched off.
4. As the affected user, run certutil.exe -deleteHelloContainer, warn them that saved passkeys will be removed, then sign out and back in.
5. If that fails, take ownership of the Ngc folder, rename it to Old_Ngc, create a new empty Ngc folder and reboot, warning every user on the device first.
6. If the PIN works but biometrics don’t, stop the Windows Biometric Service, back up and clear WinBioDatabase, restart the service and re-enrol.
7. Reinstall the camera or fingerprint drivers, and check camera privacy settings and the BIOS or UEFI.
8. If the problem returns after a shutdown, turn off Fast Startup locally, or centrally with HiberbootEnabled set to 0.
9. Check the TPM, the account type, Windows updates and system files.
10. Read the Biometrics, User Device Registration and HelloForBusiness logs in Event Viewer for the specific failure.

References

• Windows Hello for Business policy settings – the Group Policy settings that control Hello and biometrics
• Windows Hello for Business FAQ – deleting a Hello container with certutil
• Windows identity protection settings in Intune – the Intune equivalents for Entra-joined devices

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.