What Does This Error Mean?

Error 0x80090016 maps to the NTSTATUS code NTE_BAD_KEYSET — "Keyset does not exist." Windows is trying to use a cryptographic key that was previously created inside the TPM (Trusted Platform Module), but that key is no longer present or readable. The error surfaces most often in:

  • Windows Hello for Business sign-in prompts
  • Microsoft 365 / Azure AD authentication popups
  • Outlook or Teams repeatedly asking for credentials
  • BitLocker attempting to seal or unseal drive keys
  • Intune compliance checks that rely on device attestation

The underlying cause is always a mismatch: Windows believes a key lives in the TPM, but the TPM has no record of it.

Common Root Causes

TPM was cleared or reset. A BIOS/UEFI update, a motherboard swap, or someone manually clearing the TPM in firmware settings destroys all resident keys. Windows does not automatically know this happened.

User profile was migrated or copied. Moving a profile between machines (or restoring from backup) copies Windows credential store data that references TPM keys tied to the source machine's TPM — keys that do not exist on the destination.

Azure AD / Intune re-join without cleanup. Re-enrolling a device without first properly removing it from Azure AD can leave orphaned certificate and key references in the user's credential cache.

Firmware TPM (fTPM) mode change. Switching between discrete TPM and firmware TPM (AMD fTPM / Intel PTT) in UEFI invalidates stored keys even if the TPM was not explicitly cleared.

Windows Hello PIN provisioning failure. A partially completed Hello for Business provisioning leaves a key reference that points nowhere.

Diagnosis Steps

1. Check TPM health in tpm.msc. Press Win+R, type tpm.msc, and check the status field. "The TPM is ready for use" is expected; any other status indicates a hardware or driver problem that must be fixed first.

2. Review Event Viewer logs. Open Event Viewer and navigate to Applications and Services Logs > Microsoft > Windows > TPM > Operational. Look for Event IDs 1794, 1795, or any error mentioning NTE_BAD_KEYSET or 0x80090016.

3. List user certificates referencing TPM keys.

certutil -user -store My

Look for certificates where the provider is listed as Microsoft Platform Crypto Provider. These are TPM-backed; if the underlying key is gone, they will fail.

4. Check Windows Hello key status via PowerShell.

dsregcmd /status

Review the NgcSet and NgcKeyNotValid fields under the User State section. NgcKeyNotValid : YES confirms the Hello key is corrupt.

5. Check Azure AD join state. In the same dsregcmd /status output, confirm AzureAdJoined : YES and DomainJoined matches your environment. A hybrid join that has lost its AAD token is a common cause.

Fix: Clear the Corrupt NGC (Windows Hello) Keys

For the majority of cases — particularly where Outlook or Teams repeatedly prompts — the fix is to delete the corrupt Hello key container and let Windows re-provision it.

# Run in an elevated PowerShell session as the affected user (not SYSTEM) $ngcPath = "$env:LOCALAPPDATA\Microsoft\Ngc" takeown /f $ngcPath /r /d y icacls $ngcPath /grant "$env:USERNAME:(OI)(CI)F" /t Remove-Item -Path $ngcPath -Recurse -Force

After deletion, lock the workstation and sign back in. Windows will reprovision a Hello PIN if the device is AAD-joined and Hello for Business policy is active.

Fix: Re-enrol the Device in Intune / Azure AD

If the device-level certificate is affected (not just the user key), a full device re-enrolment is required.

  1. Back up any local data not covered by OneDrive or network shares.
  2. In Settings > Accounts > Access work or school, disconnect the Azure AD account.
  3. In the Azure AD portal (or via Intune admin), delete the device object to avoid duplicate records.
  4. Restart, re-join Azure AD via Settings > Accounts > Access work or school > Connect, and allow Intune auto-enrolment to complete.
  5. Verify with dsregcmd /status that AzureAdJoined : YES and a new device certificate has been issued.

Fix: Clear TPM Keys in BIOS/UEFI (Last Resort)

⚠️Clearing the TPM destroys all keys sealed to it — including BitLocker volume master keys. Suspend or back up BitLocker recovery keys before proceeding. Failure to do so may result in unrecoverable data loss.

If the TPM itself has become inconsistent (fTPM firmware bug, BIOS update), clear it from within the firmware:

  1. Suspend BitLocker on all drives: manage-bde -protectors -disable C:
  2. Save the BitLocker recovery key to Active Directory or Azure AD before clearing.
  3. Restart into BIOS/UEFI > Security > TPM / Security Device and select Clear TPM.
  4. Boot into Windows. The OS will re-initialise the TPM automatically.
  5. Re-enrol BitLocker: manage-bde -on C: -RecoveryPassword -SkipHardwareTest
  6. Re-provision Windows Hello and re-enrol Intune as described above.

Prevention

  • Before any BIOS/UEFI update, suspend BitLocker and note the recovery key.
  • Never clone or image a drive that has BitLocker enabled — always decrypt first.
  • Use Intune Autopilot Reset rather than manual re-joins to preserve clean device records.
  • Monitor Intune device compliance dashboards for machines flagged as non-compliant due to key attestation failures.
  • Set an Intune device configuration policy to back up BitLocker recovery keys to Azure AD automatically.
ℹ️If this error is appearing across multiple machines simultaneously, investigate whether a recent BIOS update was pushed via your RMM tool or Windows Update for Business — a batch firmware update is a common trigger for widespread NTE_BAD_KEYSET incidents.