Fix NTE_SILENT_CONTEXT (0X80090022) Provider Silent Context Error

Getting the 0X80090022 – NTE_SILENT_CONTEXT error is maddening. It usually pops up when you try to log in with a PIN, unlock BitLocker, or sign into a work account, and Windows just says nope – silently. Here's the fix.

First fix: Reset your Windows Hello PIN

This works on Windows 10 and 11. The error means the PIN's cryptographic keys got corrupted or the TPM can't verify them without a user prompt. Resetting the PIN rebuilds those keys from scratch.

1. Press Windows key + I to open Settings.
2. Go to Accounts > Sign-in options.
3. Under Windows Hello PIN, click I forgot my PIN.
   You'll see a prompt asking you to verify your identity. That's expected – the system needs a fresh start.
4. Click Continue. You'll be asked for your Microsoft account password or a security code sent to your phone.
5. Enter the new PIN twice. Keep it simple but don't reuse the old one. Click OK.
6. Restart your computer. After restart, try whatever action gave you the error – sign in, unlock BitLocker, or open a VPN client.
   You should not see the error anymore. If you still do, move to the next fix.

Second fix: Clear TPM keys and reinitialize (Windows 11)

If the PIN reset didn't work, the TPM itself has stale keys. You need to clear them. Caution: this will break BitLocker if you don't have your recovery key handy. Do not skip the backup step.

1. Press Windows key + R, type tpm.msc, and press Enter.
   The TPM Management console opens. You should see status: The TPM is ready for use.
2. In the right pane, click Clear TPM.
   A warning tells you this resets the TPM to factory defaults. Have your BitLocker recovery key saved! If you don't have it, stop here and find it first.
3. Click Restart. The computer restarts and prompts you to press a key to clear the TPM. Follow the on-screen instructions.
4. After reboot, Windows Hello will ask you to set up a PIN. Do that.
   This rebuilds the cryptographic context from scratch. The error should be gone.

Why this happens

The error 0X80090022 means the TPM (Trusted Platform Module) can't perform a cryptographic operation without user interaction – the context was acquired as silent. Windows tried to use a stored credential (like your PIN's key) but the TPM said, “I can't do that without a password or physical presence.” Common triggers:

• You updated Windows or the TPM firmware.
• You changed your Microsoft account password.
• The PIN's key file (stored in %LocalAppData%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings) got corrupted.
• BitLocker pre-boot authentication needs TPM seal, but the seal is broken.

The fix works because resetting the PIN or clearing the TPM forces Windows to negotiate a new key pair with the TPM interactively – not silently.

Less common variations and their fixes

If you're using a VPN or third-party credential provider

Some VPNs (like Cisco AnyConnect) or smart card middleware store their own keys in the TPM. If the error appears when connecting to VPN:

1. Open Control Panel > Credential Manager.
2. Click Windows Credentials.
3. Find entries related to your VPN (e.g., *.vpn.company.com).
4. Click Remove next to each.
5. Reconnect to VPN and re-enter credentials.
   This clears stale cached contexts.

If the error shows during Azure AD / Entra ID sign-in

You might see this in Event Viewer under Microsoft-Windows-AAD/Operational event ID 1098. Fix:

1. Run dsregcmd /status in Command Prompt (Admin).
2. If the output shows AzureAdJoined: YES and WorkplaceJoined: NO, try: dsregcmd /leave.
3. Reboot.
4. Rejoin Azure AD via Settings > Accounts > Access work or school > Connect.
   The rejoin creates a fresh TPM-bound context.

If the error occurs after a Windows Feature Update

Sometimes the upgrade process corrupts the PIN's data. Instead of resetting PIN, try:

1. Open an elevated Command Prompt.
2. Type certutil -csp Microsoft Software Key Storage Provider -key and press Enter.
3. Look for any keys with the name Microsoft Account or Windows Hello. Note their key container names (like {GUID}).
4. Delete them with certutil -delkey container_name.
   This removes the corrupted TPM keys without clearing the entire TPM.
5. Restart and set up PIN again.

Preventing this from happening again

• Before major Windows updates, temporarily switch to a password login, then back to PIN after the update.
• Don't let your TPM firmware update fail midway – always keep the computer plugged in during updates.
• If you use BitLocker, save your recovery key to a second device or cloud account.
  This way, clearing the TPM is always a safe option.
• Avoid changing your Microsoft account password while you're logged in with a PIN. Log out, change password, then set up PIN again.

The silent context error is annoying but it's just Windows being overly cautious about security. Once you know the fix – reset the PIN or clear the TPM – you're back in control.