My new pin kept getting erased when I tried to change Windows Hello pin

Hello,

What you experienced when changing your Windows Hello PIN is far more likely to be a glitch in the Windows Hello credential provider than evidence of a remote compromise. Windows Hello relies on the TPM and local credential storage, and when you change the PIN, the system updates the key material tied to the TPM. If the UI or the credential provider service (NgcCtnrSvc) momentarily fails to commit the change, you can see behavior like the PIN disappearing or not being accepted until you retry. This can happen if the TPM was busy, if there was a delay in writing to the local Ngc folder under %ProgramData%\Microsoft\Ngc, or if the system was under load at the time.

A remote trojan would not typically manifest by erasing or blocking PIN changes in this way. Malware targeting credentials usually aims at stealing them, not interfering with the Windows Hello PIN reset workflow. The fact that persistence allowed you to eventually set the new PIN successfully points to a transient issue in Windows Hello’s provisioning process rather than malicious interference.

If you want to be thorough, you can check Event Viewer under Applications and Services Logs > Microsoft > Windows > User Device Registration and Microsoft > Windows > HelloForBusiness for warnings or errors at the time you attempted the PIN change. That will confirm whether the system logged a provisioning error. Running a full Windows Defender scan and ensuring your system is patched is also good practice, but based on your description, this was a glitch in Windows Hello rather than a trojan.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.