Windows 11 does not have a built-in feature called "Pinlock," so this error typically stems from third-party security software, a misconfigured Group Policy, or a hardware lock on the device itself. To resolve the issue after a factory reset, you must identify whether the block is coming from an installed antivirus suite, a managed enterprise policy, or a physical keyboard lock.
Distinguishing Between Software and Hardware Locks
The term "Pinlock" is often confused with PIN-based login requirements or physical keyboard locks found on convertible tablets. Before attempting complex software fixes, it is crucial to determine the source of the restriction. If your tablet has a detachable keyboard, check for a physical lock switch that disables the touchpad or keyboard input, which can sometimes be mistaken for a system-wide lock. However, if the operating system prevents you from entering the Windows Hello PIN during startup or login, the issue is almost certainly related to authentication services or security policies rather than a non-existent "Pinlock" feature. After a factory reset, Windows attempts to restore default authentication methods. If the system believes it is in a secure state but the underlying services are corrupted, it may refuse to accept new PINs. This is distinct from a password prompt; the PIN is tied to the specific hardware TPM (Trusted Platform Module). If the TPM was reset or cleared during the factory process, the existing PIN cache becomes invalid, causing the system to hang or display generic error messages when trying to unlock the device.Resetting Authentication Services via Safe Mode
When standard troubleshooting fails, booting into Safe Mode allows you to bypass third-party drivers and some security checks that might be interfering with the login process. This method is particularly useful if a residual security application from before the reset is blocking access. To enter Safe Mode, you can use the following steps:- Hold down the
Shiftkey on your external keyboard. - Click the Power icon in the bottom right corner of the login screen and select Restart.
- Keep holding
Shiftuntil the "Choose an option" blue screen appears. - Navigate to Troubleshoot > Advanced options > Startup Settings.
- Press F4 or 5 to enable Safe Mode with Networking.
Cleaning Up Corrupted Credential Files
If logging in via password works, you need to remove the corrupted PIN data so Windows can generate a fresh one. These files are stored in a hidden system folder and cannot be deleted while the user is logged in normally. You will need to access the system account or use a command prompt with administrative privileges. First, ensure you are in Safe Mode or have administrative access. Open File Explorer and navigate to the following path, replacing<username> with your actual account name:
C:\Users\\AppData\Microsoft\Ngc
You may encounter permission errors. If so, right-click the Ngc folder, select Properties, go to the Security tab, and take ownership of the folder. Once you have access, delete all contents inside the Ngc folder. Do not delete the folder itself, only its contents. This action removes the cached PIN and biometric data. After clearing these files, restart your computer normally. Windows will detect the missing PIN data and prompt you to set up a new PIN during the next login sequence.
Checking for Third-Party Security Interference
Many users install comprehensive security suites like McAfee, Norton, or Bitdefender before performing a factory reset. Sometimes, these applications do not fully uninstall during the reset process due to deep-level driver integration. If the factory reset did not completely wipe these drivers, they may re-enable their own "lockdown" features upon reboot, mimicking a system lock. Check your list of installed programs by pressingWin + I to open Settings, then navigating to Apps > Installed apps. Look for any security software that was pre-installed on your device or previously used. If you find remnants of such software, uninstall them immediately. Some enterprise-grade security tools enforce strict login policies that override Windows Hello settings. Removing these tools often restores control over the native Windows authentication methods.
For more information on managing system stability after major changes, see our guide on [HP Stream Netbook: Unable to Factory Reset](/news/1353405/hp-stream-netbook-large-windows-sys32-folders-prevent-factory-reset) to understand common pitfalls in the reset process.
Re-registering the Device with Microsoft Account
In some cases, the link between your hardware ID and your Microsoft account gets disrupted after a reset. This can cause the system to reject PIN entries because it cannot verify the device's trust status. Ensure that you are connected to the internet during the setup phase. Go to Settings > Accounts > Your Info and verify that your account is properly linked. If necessary, sign out and sign back in to refresh the token. This step ensures that the cloud-based verification required for PIN creation is active and functional.Frequently Asked Questions
Why does my Windows 11 tablet keep asking for a PIN after I deleted the Ngc folder?
Deleting the Ngc folder forces Windows to forget the old PIN, which triggers the setup wizard to ask for a new one. You must create a new PIN to proceed. If it loops, ensure your date and time settings are correct, as incorrect time can invalidate security tokens.
Can I use a password instead of a PIN permanently?
Yes, you can disable the requirement for a PIN. Go to Settings > Accounts > Login options and toggle off "Require Windows Hello sign-in for Microsoft accounts." This allows you to use your traditional password for all logins.
What should I do if the Ngc folder is empty or doesn't exist?
If the folder is empty or missing, the PIN data was already cleared or never created. The issue likely lies with the Windows Biometric Service. Restart the service via services.msc or reinstall the latest chipset drivers from your manufacturer's website.
Does a factory reset always clear third-party security locks?
No. Some advanced security software installs kernel-level drivers that persist through standard resets. You must manually uninstall these applications from the Control Panel or use their dedicated removal tools to ensure they are completely gone.
How do I know if my tablet has a physical keyboard lock?
Check the edges of your detachable keyboard for a small switch or button labeled with a lock icon. If enabled, it physically disconnects the keyboard from the tablet. Toggle it off and reconnect the keyboard to see if input returns.