BitLocker network unlock fails due to malformed DHCP Option 43

Question

Hi Microsoft

I am setting up a Windows Server environment to support PXE boot for client workstations using bitLocker network unlock. The setup works partially, but I am facing issues during the boot process where clients fail to automatically unlock and instead drop to the manual password recovery screen.

Network traces indicate that the DHCP Option 43 vendor‑specific information is malformed, causing the Network Unlock payload to be rejected by the client.

The specific issues I am facing:

1. PXE clients fail to receive Network Unlock keys during boot they fall back to manual recovery every time

DHCP Option 43 string values appear malformed in packet captures

The WDS/DHCP server sends payloads that clients discard due to incorrect vendor formatting

I have reviewed the DHCP configuration and verified the WDS setup, but the issue persists. Could anyone share the correct way to format Option 43 string values for BitLocker Network Unlock so that clients can successfully process the payload?

Answer 1

Hello Amira Hammid,

With BitLocker Network Unlock, DHCP Option 43 is crucial, as it carries the vendor-specific payload containing the key information. The most common error is incorrect formatting of the hexadecimal string values. Microsoft requires that Option 43 be correctly encoded as vendor-specific information with suboption 1 (vendor class identifier) ​​and suboption 2 (vendor-specific payload). The values ​​must be specified as a continuous hexadecimal string without separators, with each suboption including its length and value. An example of the correct syntax in Windows DHCP would be:

Option 43 HEX: 0104 4E554C4C 0204 <PayloadHex>

Here, 0104 4E554C4C represents the Vendor Class "NULL" and 0204 <PayloadHex> represents the actual Network Unlock payload. It is important that the length is specified correctly and that no ASCII strings or incorrectly placed quotation marks are used. In the DHCP console, the value must be entered as "Hex," not as a "String."

If the packets still appear as "malformed" in the trace, you should check whether the DHCP server is actually sending Option 43 as a hexadecimal value and whether the WDS role with the Network Unlock provider is correctly installed. After correcting the Option 43 formatting, the clients accept the payload and BitLocker Network Unlock works again without manual input.

If my answer is helpful, please click "Accept the answer" to support me.

Thank you,

Domic.