Windows Hello for Business fails in three places: the prerequisite check before provisioning (no PIN prompt, just Event 360), the Create a PIN step (a code such as 0x801C03ED or 0x80090036), and later at sign-in or PIN reset. This reference lists the codes and messages Microsoft documents for each, with the meaning, the usual cause on an Intune-managed PC and the first check. For a step-by-step fix of the common provisioning failures, see Windows Hello for Business provisioning errors in Intune.
Codes in this quick reference
Event ID 358: Windows Hello for Business provisioning will be launched. (prerequisites passed)Event Viewer (User Device Registration/Admin)Event ID 360: Windows Hello for Business provisioning will not be launched.Event Viewer (User Device Registration/Admin)Event ID 362: Windows Hello for Business provisioning will not be launched. (enterprise STS: No)Event Viewer (User Device Registration/Admin)0x80090005 NTE_BAD_DATAWindows Hello PIN setup0x8009000F The container or key already exists.Windows Hello PIN setup0x80090011 The container or key wasn't found.Windows Hello PIN setup0x80090029 TPM isn't set up.Windows Hello PIN setup0x8009002A NTE_NO_MEMORYWindows Hello PIN setup
+ 39 more codes in the tables below.
How to read these codes#
- Prerequisite check. Provisioning starts after the user profile loads, before the desktop appears, and only if every prerequisite passes. The result is logged in Applications and Services Logs › Microsoft › Windows › User Device Registration › Admin: event 358 when provisioning will launch, 360 (or 362 in certificate trust) when it won't, with one line per prerequisite marked Yes, No or Not Tested.
- dsregcmd. Run
dsregcmd /statusas the user, not elevated. The Ngc Prerequisite Check section mirrors the event (IsDeviceJoined,IsUserAzureAD,PolicyEnabled,PostLogonEnabled,DeviceEligible,SessionIsNotRemote,PreReqResult) and may disappear once Windows Hello is set up; User State then showsNgcSet : YESand anNgcKeyId. - The PIN wizard. Failures after the prerequisites pass show a code on the Create a PIN screen.
0x8009…codes come from key storage and the TPM, and0x801C…from device registration and key registration with Microsoft Entra ID.0xCAA30193is an HTTP 403 (0x193is 403) returned by a server, proxy or firewall.
Microsoft's general ladder for wizard errors: try again (some are transient), sign out and back in, restart, and only then unjoin and rejoin the device (Settings › System › About › Disconnect from organization). On an Intune device rejoining means re-enrolling, so keep it for last. If both Group Policy and Intune configure Windows Hello for Business, Group Policy wins and the Intune settings are ignored (Microsoft Learn).
PowerShell
dsregcmd /status # as the signed-in user, not elevated
Get-WinEvent -LogName 'Microsoft-Windows-User Device Registration/Admin' -MaxEvents 100 |
Where-Object Id -in 358, 360, 362 | Select-Object TimeCreated, Id, Message -First 3
Get-Tpm # elevated: TpmPresent and TpmReady should be TrueProvisioning events#
| Event | Meaning | Usual cause | First check |
|---|---|---|---|
| 358 | Windows Hello for Business provisioning will be launched. | All prerequisites passed (informational) | If no prompt follows, look for a wizard code |
| 360 | Windows Hello for Business provisioning will not be launched. | A prerequisite line reads No: not joined, not signed in with Entra credentials, policy off, hardware not eligible, or a remote session | The line marked No (Event 360 explained) |
| 362 | Windows Hello for Business provisioning will not be launched. (Warning) with User has successfully authenticated to the enterprise STS: No | Certificate trust with AD FS: device authentication to AD FS fails (a newly joined device can need time) | AD FS/Admin event 1021 with MSIS9368 for scope ugs: on AD FS 2019, add the ugs scope |
PIN creation codes with a documented fix#
TPM and key storage (0x8009…)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80090005 | NTE_BAD_DATA | Damaged key data | Microsoft's fix: unjoin and rejoin |
0x8009000F | The container or key already exists. | A leftover Windows Hello container | Unjoin and rejoin; many admins first try certutil.exe -deleteHelloContainer as the user, then sign out |
0x80090011 | The container or key wasn't found. | Missing or damaged container | As for 0x8009000F |
0x80090029 | TPM isn't set up. | TPM not initialized | As an administrator, tpm.msc › Prepare the TPM |
0x8009002A | NTE_NO_MEMORY | Low memory | Close programs and retry |
0x80090031 | NTE_AUTHENTICATION_IGNORED | TPM problem | Restart; if it recurs, reset the TPM (Clear-TPM) after confirming the BitLocker recovery key is escrowed |
0x80090035 | Policy requires TPM and the device doesn't have TPM. | A TPM-required policy on a device without a usable TPM | Enable the TPM in firmware, or relax the TPM requirement deliberately |
0x80090036 | User canceled an interactive dialog. | The user closed a prompt | Ask the user to try again |
Device registration and federation (0x801C00…)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x801C0003 | User isn't authorized to enroll. | The user lacks permission for the operation | Who may join or register devices in Microsoft Entra device settings |
0x801C000E | Registration quota reached. | Too many devices for this user | Remove stale devices or raise the maximum number of devices per user |
0x801C000F | Operation successful, but the device requires a reboot. | Pending restart | Restart |
0x801C0010 | The AIK certificate isn't valid or trusted. | TPM attestation certificate problem | Sign out and back in |
0x801C0011 | The attestation statement of the transport key is invalid. | Attestation problem | Sign out and back in |
0x801C0012 | Discovery request isn't in a valid format. | Discovery problem | Sign out and back in |
0x801C0015 | The device is required to be joined to an Active Directory domain. | An on-premises deployment on a device that isn't domain joined | Join the device to the domain |
0x801C0016 | The federation provider configuration is empty | Federation configuration problem | http://clientconfig.microsoftonline-p.net/FPURL.xml isn't empty |
0x801C0017 | The federation provider domain is empty | As above | The FPDOMAINNAME element in that file |
0x801C0018 | The federation provider client configuration URL is empty | As above | The CLIENTCONFIG element holds a valid URL |
Key registration and tokens (0x801C03…, 0x801C04…)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x801C03E9 | Server response message is invalid | Bad response from the registration service | Sign out and back in |
0x801C03EA | Server failed to authorize user or device. | Invalid token, or the user can't register keys | Token validity and the user's right to register Windows Hello keys |
0x801C03EB | Server response http status isn't valid | Unexpected HTTP status | Sign out and back in |
0x801C03EC | Unhandled exception from server. | Service-side error | Sign out and back in |
0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed. (also: token not found, invalid request, or no permission to join Microsoft Entra ID) | No MFA claim in the sign-in, or users not allowed to join devices | Sign out and in with MFA; allow users to join in Microsoft Entra device settings |
0x801C03EE | Attestation failed. | TPM attestation | Sign out and back in |
0x801C03EF | The AIK certificate is no longer valid. | Expired attestation certificate | Sign out and back in |
0x801C03F2 | Windows Hello key registration failed. | ERROR_BAD_DIRECTORY_REQUEST: another object has the same proxyAddresses value | Fix the duplicate attribute; Mail must match the primary SMTP address |
0x801C044D | Authorization token doesn't contain device ID. | The device identity is missing from the token | Microsoft's fix: unjoin and rejoin |
0x801C044E | Failed to receive user credentials input. | Credential prompt didn't complete | Sign out and back in |
0x801C0451 | User token switch account. | Stale Web Account Manager token cache | Delete %LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts contents and restart |
Codes Microsoft lists without a mitigation#
Microsoft's advice for these is to contact support. Work through the general ladder first and collect dsregcmd /status output and the User Device Registration log for the case.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80090020 | NTE_FAIL | Generic key storage failure | Get-Tpm; TPM firmware updates |
0x8009002D | NTE_INTERNAL_ERROR | Internal key storage error | As above |
0x801C0001 | ADRS server response isn't in a valid format. | Registration service response damaged | Proxy or TLS inspection on enterpriseregistration.windows.net |
0x801C000C | Discovery failed. | Registration service discovery failed | Network path (DNS, proxy) to enterpriseregistration.windows.net |
0x801C0013 | Tenant ID isn't found in the token. | Token problem | AzureAdPrt under SSO State |
0x801C0014 | User SID isn't found in the token. | Token problem | As above |
0x801C001B | The device certificate isn't found. | Device identity damaged | DeviceCertificateValidity and DeviceAuthStatus in dsregcmd |
0x801C004D | DSREG_NO_DEFAULT_ACCOUNT: no default WAM account for the Entra token | The user has no default Web Account Manager account | WamDefaultSet : YES and a PRT (PRT troubleshooting) |
0x801C03F0 | There's no key registered for the user. | Key missing in Microsoft Entra ID | NgcSet and NgcKeyId; provision again |
0x801C03F1 | There's no UPN in the token. | Not signed in with an Entra account | IsUserAzureAD in dsregcmd |
0xCAA30193 | HTTP 403 Request Forbidden | The request left the device; a server, proxy or firewall refused it | Proxy and firewall rules for Microsoft Entra sign-in endpoints |
Sign-in and PIN reset errors#
| Error | Meaning | Usual cause | First check |
|---|---|---|---|
0xC00000BB Your PIN or this option is temporarily unavailable. | The domain controller doesn't support the sign-in method | Most often the KDC lacks a suitable certificate; or the client can't check the KDC certificate's CRL | Domain controller certificates and CRL reachability; sign in another way meanwhile |
That option is temporarily unavailable. For now, please use a different method to sign in. | Hybrid key trust sign-in failed | The key hasn't synced to msDS-KeyCredentialLink yet; or domain controllers with known bugs | Wait for the next Entra Connect sync; patch Windows Server 2016 (KB4593226) and 2019 (KB4592440) DCs |
We can't open that page right now | PIN reset blocked on an Entra joined device | The reset flow tried to open a federated identity provider page outside the allowlist | Add the domains with the ConfigureWebSignInAllowedUrls policy |
Event 107 The Kerberos client received a KDC certificate that does not have a matched domain name. | On-premises access fails from an Entra joined device (key trust) | Domain controller certificates from a non-Microsoft CA | The DC certificate needs its distinguished name in the subject, or a SAN with the DC FQDN, domain DNS name and NetBIOS name (the log is off by default) |
Tip: On-premises single sign-on with cloud Kerberos trust is covered in deploying cloud Kerberos trust with Intune; there, OnPremTgt : YES under SSO State is the sign of a working setup.
How to verify a fix#
- Sign out and back in: the prerequisite check runs at sign-in, and event 358 should replace 360 or 362.
- Complete Create a PIN, then run
dsregcmd /statusas the user:NgcSet : YESwith anNgcKeyIdunder User State andAzureAdPrt : YESunder SSO State. - Lock the device and sign in with the PIN. For hybrid key trust, test again after the next Entra Connect sync.
References#
- Windows Hello errors during PIN creation (Microsoft Learn): codes, causes and mitigations
- Windows Hello for Business known deployment issues (Microsoft Learn): sign-in, PIN reset and event 362
- Troubleshoot devices by using the dsregcmd command (Microsoft Learn): NGC prerequisite fields
