Network Unlock policy fails to unlock data volumes after reconnecting the client to the network

Technical Articles ID: KB86213
Last Modified: 2022-10-14 09:58:37 Etc/GMT

Environment

Management of Native Encryption (MNE) 5.x, 4.x

Microsoft Windows BitLocker

For details, see KB79375 - Supported platforms for Management of Native Encryption.

Problem

Data drives locked by the MNE Network Unlock (System Authentication) policy feature fail to unlock data volumes. The issue is seen on systems when a network connection is not present during the MNE service startup. But, it then becomes available after the MNE service has loaded.

IMPORTANT: This issue is not seen if a network connection is present when the MNE service starts, or when the connection is lost temporarily, but then reconnects.

The MneService_Activity.log (client) records the following errors:

MNEService	<SYSTEM>	EncryptionProvider.Activity: Volume X: is locked.
MNEService	<SYSTEM>	EncryptionProvider.Activity: Volume X: will attempt Network Unlock with protector ID FC1B21BBE7ED4AC8BD43F0C1C83CDB2E
MNEService	<SYSTEM>	isdp.key_provider.KeyRequestBuilder.Error: Failed to generate asymmetric key pair
MNEService	<SYSTEM>	NetworkUnlock.Activity: Processing volume: Volume{983da88a-4562-4464-997d-409ea8b1fe71}\

Cause

The issue is seen on clients such as the following:

Systems that don't have the RDRAND instruction (code name Bull Mountain)
Systems that don't have the Ivy Bridge (microarchitecture) chipset or later
Drives locked by the Network Unlock (System Authentication) policy feature fail to unlock, when no network connection is present when the MNE service starts

This issue occurs because the MNE Core Crypto module can't generate entropy. MNE uses the randomness of the network connection, which is initialized at startup.

NOTE: The above still occurs when the network connection is established after the MNE service has loaded.

Solution

This behavior is as expected.

Make sure that the system is connected to the network during a system startup. Doing so makes sure that the MNE service has a network connection present at system startup.
Restart the system after it's reconnected to the network for the Network Unlock feature to operate.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Network Unlock policy fails to unlock data volumes after reconnecting the client to the network

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Network Unlock policy fails to unlock data volumes after reconnecting the client to the network

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title