Hi,
I am trying to get BitLocker Network Unlock feature to work, but with no luck. Client computer allways asks for PIN.
Symptoms on the client side are simple: Event with ID 24645 saying Bootmgr failed to obtain the BitLocker volume master key from the network key protector occures on every boot.
Symptoms on server side (WDS) are more specific:
When the server starts, it logs several events with ID 24577 covering NKPPROV initialization that is successful. There is only one warning with ID 32770
[WDSServer/WDSPXE/NKPPROV] Could not find the configuration file section corresponding to the specified certificate thumbprint. No subnet restrictions will apply to this certificate. Certificate thumbprint = 59FAB93B3986D7CBCB848CAFB720C608097F583C,
HRESULT = 0x80070002.
Than WDS logs repeatedly event with ID 32769 [WDSServer/WDSPXE/NKPPROV] Change notification callback found no NKP configuration file changes.
When client boots, WDS logs two events with ID 32769
[WDSServer/WDSPXE/NKPPROV] Received NKP IPv4 request. Remote address: 10.10.64.100:68, Packet length: 573.
followed by
[WDSServer/WDSPXE/NKPPROV] NKP request processing succeeded. Remote address: 10.10.64.100:68, Reply packet length: 316.
There is nothing more related to BitLocker Network Unlock in WDS logs.
I´ve set up the whole thing with help of this TechNet article: https://technet.microsoft.com/en-GB/library/jj574173.aspx
As mentioned in that article, or in other discussions, I´ve checked:
UEFI Network stack on client is enabled
Client can boot to UEFI PXE to the same WDS (pressing F12 during boot and enter into WDS menu)
SecureBoot is enabled and CSM is disabled - client can boot only by UEFI
Manage-bde -protectors -get C: on the client with result:
Volume C: []
All Key Protectors
Numerical Password:
ID: {5FD95464-29ED-4B04-9EB0-8B2C3D5758F4}
Password:
{PASSWORD}
TPM And PIN:
ID: {34405DBF-B49E-4836-9898-1FAFEF7B962F}
PCR Validation Profile:
0, 2, 4, 11
External Key:
ID: {C4B47A8F-FC53-485E-98D4-A3C9B0D216CD}
External Key File Name:
C4B47A8F-FC53-485E-98D4-A3C9B0D216CD.BEK
Network (Certificate Based):
ID: {69EC0722-A8F9-4185-9315-DAAC4D0386DF}
PCR Validation Profile:
0, 2, 4, 11
Certificate Thumbprint:
59fab93b3986d7cbcb848cafb720c608097f583c
BitLocker logs in API log on the client also warning with ID 813: BitLocker cannot use Secure Boot for integrity because the expected TCG Log entry for variable 'SecureBoot' is missing or invalid.and event with ID 834: BitLocker determined that the TCG log is invalid for use of Secure Boot. The filtered TCG log for PCR[7] is included in this event.
Certutil -verifystore FVENKP on WDS server with result
FVENKP "BitLocker Drive Encryption Network Unlock"
================ Certificate 0 ================
Serial Number: 3e00000003db4cae7e034cbb0b000000000003
Issuer: CN=Internal CA
NotBefore: 14.02.2017 15:50
NotAfter: 14.02.2019 15:50
Subject: CN=BitLocker Network Unlock Certificate for domain
Non-root Certificate
Template: BitLockerNetworkUnlock, BitLocker Network Unlock
Cert Hash(sha1): 59 fa b9 3b 39 86 d7 cb cb 84 8c af b7 20 c6 08 09 7f 58 3c
No key provider information
Provider = Microsoft Software Key Storage Provider
Simple container name: te-BitLockerNetworkUnlock-c393e00f-96dc-46b8-8d7b-e4a13a8a7eba
Unique container name: 7b916d8b5ba7dd1d829dda5fcd7f0e11_e7b28bda-a4b3-4265-bf49-b1de94b42c9d
ERROR: missing key association property: CERT_KEY_IDENTIFIER_PROP_ID
Encryption test passed
Verified Issuance Policies: None
Verified Application Policies:
1.3.6.1.4.1.311.67.1.1 BitLocker Network Unlock
Certificate is valid
CertUtil: -verifystore command completed successfully.
So I cannot figure out why network unlock fails. WDS logs says it successfuly processed the request, but I can´t find why client doesn´t use it.
George