![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 99%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
The described behavior (no timeout and hang at OEM logo when offline) is not documented in the provided context as a known BitLocker or Network Unlock issue for Windows 11 25H2, so only general, supported troubleshooting and mitigation steps can be given.
Based on the context, focus on validating and, if necessary, simplifying the Network Unlock configuration and verifying that the client firmware and DHCP behavior are fully compliant. For affected devices, use one of the following mitigations until a product fix or OEM/firmware update is available:
- Temporarily disable Network Unlock for mobile devices
Since disabling the Allow network unlock at startup GPO restores normal PIN-based startup, apply this GPO only to stationary, wired systems (desktops/servers) and remove it from mobile/undocked devices such as Lenovo X12. This aligns with the design intent that Network Unlock is for wired, domain-joined systems.- GPO path:
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Allow network unlock at startup - Set to Disabled (or unlink the GPO) for the OU that contains Lenovo X12 devices.
- GPO path:
- Verify Network Unlock configuration and certificates
Ensure there is no misconfiguration that could cause the pre-boot Network Unlock sequence to stall:- Confirm the device is UEFI-based, running in native UEFI mode with no CSM/Legacy mode enabled, and that Secure Core features are not interfering, as recommended in Network Unlock troubleshooting.
- On the client, verify that a Network Unlock protector exists:
Look for Network (Certificate Based) or TpmCertificate (9) as described in the Network Unlock and known-issues documentation.manage-bde.exe -protectors -get C: - Check that the Network Unlock certificate is present under:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\FVE_NKP\Certificates - On the WDS/Network Unlock server, verify the Network Unlock certificate is correctly installed in the appropriate certificate store and that required roles/services are running.
- Check DHCP configuration for Network Unlock
The known-issues guidance explicitly calls out DHCP configuration problems as a cause of Network Unlock failures. Ensure the DHCP server is configured for DHCP only, not DHCP and BOOTP, for the relevant scope:- If Network Unlock fails or behaves unexpectedly, change the DHCP server option from DHCP and BOOTP to DHCP as described in the known-issues article.
- Collect logs and validate policy application
For deeper troubleshooting and to support a case with Microsoft or Lenovo:- On clients, confirm the Network Unlock GPO is applied using
GPRESULT.exeorRSOP.msc. - Collect BitLocker event logs and the
Microsoft-Windows-Deployment-Services-Diagnostics-Debuglog from the WDS server, as recommended in the Network Unlock troubleshooting section. - Use the
manage-bde.exe -protectors -get C:output together with WDS debug logs to confirm that the correct certificate thumbprint is being used.
- On clients, confirm the Network Unlock GPO is applied using
- Interim user guidance
Until a permanent fix is available, document and distribute a short instruction for affected users:- If the device hangs at the Lenovo logo when offline, press ESC once to abort the Network Unlock attempt and display the BitLocker PIN prompt.
- Engage OEM and Microsoft support
Because the hang occurs at the OEM splash screen and only after a specific update, this may involve firmware/UEFI interaction with the Network Unlock DHCP driver in UEFI. Provide Lenovo and/or Microsoft support with:- Exact Windows build and May 2026 update KB number.
- Firmware version of the Lenovo X12.
- BitLocker protector configuration (
manage-bde -statusand-protectors -get C:output). - WDS debug logs and BitLocker logs.
Given the current information, the only fully reliable mitigation from the context is to remove Network Unlock from mobile/offline-boot scenarios (by scoping the Allow network unlock at startup GPO to wired-only systems) and rely on TPM+PIN for those devices.
References: