NTE_BUFFER_TOO_SMALL (0x80090028) Fix: Buffer Size Error

Quick answer: Delete the corrupt NGC folder under %LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState, then run sfc /scannow and reboot.

I've seen this error pop up mostly after a botched Windows update or when someone forces a shutdown while Windows Hello is writing keys. The 0x80090028 comes straight out of the Windows Crypto API (specifically DPAPI or NCrypt). The buffer size it's complaining about isn't some random number – it's a hard limit the OS set for protecting your credentials. When that buffer gets corrupted or truncated, the system can't read your PIN, fingerprint data, or stored passwords. It's not a hardware problem; it's a data problem.

Here's the fix sequence I've used on maybe a dozen machines this year alone.

Step 1: Delete the Corrupt NGC Folder

The most common culprit is a corrupt NGC (Next Generation Credential) folder. Windows Hello stores your PIN and biometric data here.

1. Open File Explorer, paste this into the address bar: %LocalAppData%\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState
2. Look for a folder named NGC. Right-click it and delete. Windows might complain it's in use. If so, boot into Safe Mode and do it there.
3. Reboot, then go to Settings > Accounts > Sign-in options and set up your PIN again.

Step 2: Run System File Checker

Had a client last month whose entire print queue died because of this – turned out the CBS store was corrupted. Same thing can cause DPAPI errors.

sfc /scannow

Let it finish, then run:

DISM /Online /Cleanup-Image /RestoreHealth

Reboot after both complete.

Step 3: Check for Corrupt User Profile

If steps 1 and 2 don't cut it, the profile itself might be hosed. I've seen this after a domain join gone wrong.

1. Create a new local admin account: net user tempadmin Password123 /add then net localgroup Administrators tempadmin /add
2. Log into that account. If the error doesn't appear, your old profile is toast.
3. Migrate your data from C:\Users\OldUsername to the new profile.

Alternative Fixes

Clear TPM (use only as last resort)

I don't recommend this unless you're desperate. Clearing the TPM wipes all keys – including BitLocker recovery keys. If you do it:

1. Press Win + R, type tpm.msc, hit Enter.
2. Click "Clear TPM" and reboot.
3. You'll need to re-enroll in Windows Hello and possibly re-enter BitLocker recovery key.

Reset Certificate Store

Some apps store encryption keys in the user certificate store. Run certmgr.msc, expand Personal > Certificates, look for anything dated right before the error started. Delete it. But be careful – this can break encrypted emails or remote desktop certificates.

Prevention Tip

Never force shutdown Windows during a Windows Hello setup or when you see "Setting up your PIN". Let it finish. Also, keep Windows Update current – Microsoft patched a heap of DPAPI bugs in the last two cumulative updates. If you're still on an old build, that's your first problem.