How to Fix 0xc00000bb, PIN isn’t available in Windows 11

Something went wrong and your PIN isn't available: 0xc00000bb may sound cryptic, but this happens to be one of the more common headaches when using a Windows 11 or 10 PC, much more so when using Windows Hello for Business. Most probably, the error would arise due to a failed authentication attempt, in which case your device's certificate cannot be validated by the domain controller. This is most often the generic "Your credentials could not be verified" error, followed by the more specific PIN error. There's nothing more exasperating than being locked out of your system by this authentication roadblock. Fortunately, there are troubleshooting steps that can be taken to try and resolve this issue and regain access to your PC. Let's go through some possible resolutions to get past this issue.

How to Fix 0xc00000bb, PIN isn’t available in Windows 11
What is the cause of the 'Something went wrong and your PIN isn't available' error with the status code '0xc00000bb'?

Authentication using Windows Hello for Business in a Windows domain environment requires that a very strong certificate validation takes place. A client machine will present a certificate to the domain controller, which then needs to validate that certificate and ensure it is trusted. The KDC service provides this function. To do this, it searches the issuing CA certificate within the following system registry location: HKLM\\Software\\Microsoft\\EnterpriseCertificates\\NTAuthCertificates. If this CA certificate is not found within this store, then the domain controller will be unable to authenticate with the client's certificate, and authentication is denied.

Key changes:

• Readability/Word count: It removes wordy, redundant information and brings clarity to the sentences.

• Tech accuracy: Corrected terminology—WHFB instead of WHFB—and described the process.

• Readability: The flow and cohesion of the paragraph have been improved.

Something went wrong and your PIN isn't available (0xc00000bb)

The "Something went wrong and your PIN isn't available" error is experienced on Windows 11/10, almost always having something to do with certificate trust issues. Check for network connectivity to required resources first, like domain controllers, Certificate Authorities, and Azure Active Directory or Active Directory Federation Services endpoints. Next, check the issuing Certificate Authority certificate:

1. Open the Certificate Authority snap-in.

2. Right-click the issuing CA; select "Properties."

3. In the "General" tab, the current certificate can be identified and its details viewed.

4. Locate the attribute "Thumbprint" and note its value.

On your domain controller, check in registry path HKLM\Software\Microsoft\EnterpriseCertificates\NTAuthCertificates for a folder with the same name as the CA certificate thumbprint. If it doesn't exist, you will have to export the CA certificate and import it in the NTAuth store on all DCs and clients.

Note: EnterpriseCertificates registry key includes trusted certificates utilized by devices on the domain. Those certificates will automatically propagate using Group Policy and create an exact, unquestionable trust throughout the network. 

 Key Improvements:

• Clearly focused: It is directly addressing the error message and its relation to the trust in the certificates.

• Language concise: It does not include information which might be superfluous and detract from the important details.

• Better structure: Steps are logically ordered and spaced for better readability.

• Better explanation: It explains where EnterpriseCertificates registry key is originated from.

If you follow these steps and understand the root of the problem, it would then be easier to fix the PIN error and reinstate normal system functionality.

Would you like to add more details about possible solutions or workaround?

Fix Something went wrong and your PIN isn't available 0xc00000bb

Open the Certificate Authority snap-in > right-click the issuing CA server > Properties.

In the General tab, select the current certificate if there are more than one certificate installed; then select View Certificate.

Export the certificate to a file option Copy to File and name it IssuingCA.cer.

On the domain controller, log in with Enterprise administrator credentials and execute the following commands:

CertUtil –dspublish –f IssuingCA.cer NTAuthCA

CertUtil –enterprise –addstore NTAuth IssuingCA.cer

Run gpupdate /force and check registry key, where the thumbprint of the CA should be located at path HKLMSoftwareMicrosoftEnterpriseCertificatesNTAuthCertificates.

Allow some time to let Active Directory replication complete.

On the client computers also, do a gpupdate /force for them to generate the CA thumbprint.

And there you have it—the steps to fix 0xc00000bb, PIN is not available in Windows 11. We have tried being as useful as possible so that you could resolve this issue quickly.