NTE_FAIL 0X80090020: That random error that kills your login

1. Corrupt user profile (most common cause)

I see this one all the time. You type your PIN or password and bam — NTE_FAIL 0X80090020. The system can't access your encryption keys because your profile is borked. Had a client last month whose whole print queue died because of this — turns out a bad Windows update hosed her profile.

How to fix it: Create a new local admin account and move your files over. Here's the quick way:

1. Boot into Safe Mode (hold Shift while clicking Restart, then Troubleshoot > Advanced Options > Startup Settings > Restart).
2. Once in Safe Mode, open Command Prompt as admin. Type: net user tempadmin /add then net localgroup Administrators tempadmin /add.
3. Log out, log in as tempadmin. If it works, the error is in your old profile.
4. Now copy your files from C:\Users\[oldusername] to C:\Users\tempadmin or an external drive. Don't copy the whole folder — just Documents, Desktop, Downloads, and AppData if needed.
5. Delete the old profile via System Properties > Advanced > User Profiles > Settings.
6. Rename tempadmin to your original username if you want.

This fix works 8 out of 10 times. If you still see the error, move to cause #2.

2. Corrupt TPM or TPM driver

Your TPM (Trusted Platform Module) handles encryption keys for BitLocker and Windows Hello. If its driver gets borked or the TPM chip itself has bad data, you get that 0X80090020 error. I've seen this after a BIOS update that reset TPM settings.

The fix — clear and reinitialize TPM:

1. Press Win+R, type tpm.msc, hit Enter.
2. If TPM is ready, click "Clear TPM" in the right panel. This wipes all keys — so if you use BitLocker, have your recovery key handy (it's in your Microsoft account or printed).
3. Restart your PC. It'll ask you to confirm TPM clearing in the BIOS screen.
4. After boot, go back to tpm.msc. Windows should reinitialize it automatically.
5. If it shows "TPM not detected" or error, update your TPM driver from your motherboard maker's site (Intel, AMD, or OEM like Dell/Lenovo). Don't use Windows Update for this — it's often outdated.

One time I had a client whose HP laptop kept throwing this error. Turned out the TPM firmware was old. HP had a specific tool to update it. After that, no more NTE_FAIL.

⚠️ Clearing TPM will delete your Windows Hello PIN, fingerprint, and BitLocker keys. Make sure you know your Microsoft account password or recovery key first.

3. Corrupt Windows Hello or PIN data

If you use a PIN or biometrics to log in, Windows stores that data inside a protected folder called NGC (Next Generation Credential). If that folder gets corrupt — from a bad update or a sudden shutdown — you get the error.

How to fix it:

1. Boot into Safe Mode again (same method as before).
2. Open File Explorer, go to C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc.
3. Right-click the NGC folder, go to Properties > Security > Advanced. Change owner to your admin account, give yourself full control.
4. Delete everything inside the NGC folder. Yes, all of it.
5. Reboot normally. Go to Settings > Accounts > Sign-in options > Windows Hello PIN > Remove (if still there) then Add.
6. Set a new PIN. Should work now.

If you can't even get into Safe Mode, use a Windows installation USB and open Command Prompt from the repair screen (Shift+F10). Then navigate to that NGC folder and delete it from there.

Quick-reference summary table

That's it. No fluff, no wasting time. Start with the profile fix — that's the one that'll get you sorted 80% of the time. If not, move down the list. And if you're still stuck after all three? Your hardware might have a busted TPM chip, and you'll need a motherboard replacement. But I've only seen that once in five years.