Computers stalling at network boot for BitLocker Network Unlock

Question

Computers stalling at network boot for BitLocker Network Unlock

Manon Laurent 40

We set up a new computer, but the same thing is happening with the others. The systems stall indefinitely at the network boot screen when trying to use BitLocker Network Unlock. Most of the time they just sit there, and when we looked at the network captures, it shows the PXE server didn't respond with the required Option 60 parameters. It marks it as having a problem with the DHCP server, like the parameters need to be configured for this to work, but we don't know the exact ones to set. These are UEFI endpoints.

0 comments

1 answer

Your answer

Answer 1

Hello Manon,

BitLocker Network Unlock relies on proper DHCP configuration to deliver the unlock key during the PXE boot process. The stall you’re seeing at the network boot screen is almost always due to missing or misconfigured DHCP options. For UEFI-based clients, you need to ensure that the DHCP server is configured with the correct vendor class and boot options.

Specifically, DHCP Option 60 (Class Identifier) must be set to “PXEClient” on the DHCP server. Alongside that, Option 67 (Bootfile Name) must point to the correct UEFI boot file, typically boot\x64\wdsnbp.com or boot\x64\wdsmgfw.efi depending on your Windows Deployment Services setup. Option 66 (Boot Server Host Name) should be the FQDN or IP address of the WDS server. Without these three options, the PXE handshake will not complete, and BitLocker Network Unlock cannot proceed.

For UEFI endpoints, the critical piece is that Option 67 must reference the .efi boot loader, not the legacy .com loader. If you mistakenly point to the BIOS loader, the client will hang exactly as you described. Also, confirm that your DHCP scope options are not being overridden by IP helpers on the router. If you’re using IP helpers, the WDS server must be explicitly listed so the PXE request reaches it.

Finally, ensure that the Network Unlock feature is correctly deployed: the Network Unlock certificate must be installed on the WDS server, and the Group Policy setting “Enable BitLocker Network Unlock” must be applied to the clients. If the DHCP options are correct but the certificate is missing or misapplied, the PXE boot will succeed but the unlock will fail silently.

I recommend you start by checking DHCP Options 60, 66, and 67 on your DHCP server, making sure Option 67 points to boot\x64\wdsmgfw.efi for UEFI. Once those are corrected, PXE should respond properly and BitLocker Network Unlock will proceed without stalling.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.