[Carl Hexnode 3 March 2023 Carl Moderator]

Hi @deborah,

You can disable and remove the PIN using PowerShell. Here are the steps:

Open PowerShell and execute the following commands:

Script to disable PIN via PowerShell

Set-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\System -Name "AllowDomainPINLogon" -Value 0 Set-ItemProperty HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings -Name "AllowSignInOptions" -Value 0

1 2	Set-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Windows\System -Name "AllowDomainPINLogon" -Value 0 Set-ItemProperty HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Settings -Name "AllowSignInOptions" -Value 0

This creates/modifies a Registry value for the local machine.

• The first PowerShell command disables the use of a domain PIN for login.
• The second PowerShell command disables the ability to choose sign-in options (such as Windows Hello or fingerprint) on the login screen.

Also, the NGC folder contains encrypted data files that store the biometric data and other credentials required for Windows Hello to authenticate the user.
So, the content of the file should be deletedin order toclear the any previous associated logs.

Script to grant full control to admins

Start-Process cmd -ArgumentList '/s,/c,takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /r /d y & icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /grant administrators:F /t & RD /S /Q C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc & MD C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc & icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /T /Q /C /RESET' -Verb runAs

1 2 3 4 5 6

Start-Process cmd -ArgumentList '/s,/c,takeown /f C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /r /d y & icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC /grant administrators:F /t & RD /S /Q C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc & MD C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc & icacls C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc /T /Q /C /RESET' -Verb runAs

The given script is used to take ownership and grant full control permissions to the “Administrators” group for the C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC and C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc folders, and then delete the NGC folder and recreate it as an empty folder.

Hope this helps!

Regards,
Carl Hughes
Hexnode UEM