BitLocker network unlock fails due to DHCP option 43

Question

Workstations configured with bitLocker network unlock are unable to automatically unlock when booting via PXE on remote subnets. The first issue is that while PXE boot proceeds normally, the Network Unlock mechanism fails because the client rejects the payload sent by the WDS/DHCP server.

The second issue lies in DHCP Option 43. Packet captures reveal that the payload is discarded due to missing or incorrectly formatted vendor‑specific information. As a result, the client does not recognize the Network Unlock data and ignores the packet entirely.

How should the payload in DHCP Option 43 be correctly formatted so that the client accepts it and successfully performs network unlock ?

Answer 1

Welcome to Microsoft Q&A,

Thank you for providing the detailed information.

BitLocker Network Unlock does not support a manually constructed DHCP Option 43 payload. The client expects a vendor-specific DHCP response generated by the WDS Network Unlock Provider (NKPProv) using the MS-NKPU protocol. If the payload does not conform to the protocol expected by the Windows boot manager, the response is discarded and Network Unlock fails.

The Network Unlock process works as follows:

1. The client obtains an IPv4 address through DHCP.
2. The client sends a vendor-specific DHCP request containing encrypted Network Unlock data.
3. The WDS Network Unlock provider processes the request and returns the required network key in a vendor-specific DHCP reply.
4. The client validates the response and uses the returned key material to unlock the BitLocker-protected volume.

Therefore, there is no supported static format, byte sequence, or hexadecimal layout for DHCP Option 43 that administrators can manually configure to enable BitLocker Network Unlock. The payload must be generated by the Microsoft Network Unlock provider and must conform to the MS-NKPU protocol implementation.

If packet captures show that the client is rejecting the response, I recommend you investigating the infrastructure components involved in the Network Unlock exchange, including:

• DHCP relay/IP Helper devices that may be modifying or removing vendor-specific DHCP information.
• The WDS/Network Unlock provider to ensure it is generating a valid Network Unlock response.
• DHCP and BOOTP handling across routed networks and remote subnets.
• Network devices that may not be preserving the vendor-specific DHCP data required by the Network Unlock process.

In short, the issue is typically not the value of Option 43 itself, but whether the client receives a valid MS-NKPU-compliant vendor-specific reply generated by the WDS Network Unlock provider and delivered unchanged through the network path.

For additional information, please visit: Network Unlock | Microsoft Learn
Bitlocker: Network Unlock | Microsoft Learn
BitLocker Network Unlock: known issues - Windows Client | Microsoft Learn

If you find this information helpful, please click Accept Answer.

Thank you for using Microsoft Q&A.