wireguard-windows: client forgets after restart that there was a activated tunnel before and won't activate said tunnel anymore

[Denis Brodbeck]

Dear WireGuard-Community,

TL;DR: wireguard forgets after restart that there was a activated tunnel before and won't activate said tunnel anymore unless an admin intervenes

I've deployed wireguard-windows on 50 domain-joined Windows 10 (20H1 x64) notebooks (WireGuard versions range from v0.3.14 - v.03.16) and need your assistance resolving some mysterious behavior.

Some of my users are experiencing random connectivity loses (this example here is the only time I witnessed said behaviour myself):
- admin setups and activates '20_EPNBLE-04' tunnel config
- service 'WireGuardManager' runs
- service 'WireGuardTunnel$20_EPNBLE-04' runs
- everything is fine for days/weeks -- users reboot usually daily
- user reboots / comes back from weekend
- service 'WireGuardManager' runs
- service 'WireGuardTunnel$20_EPNBLE-04' does not exist
- config '20_EPNBLE-04.conf.dpapi' under 'C:\Program Files\WireGuard\Data\Configurations' still exists, it's just not active any more
- config '20_EPNBLE-04.conf.dpapi' *stays* inactive (multiple reboots), unless an admin re-activates it via WireGuard UI

My 99% windows environment:
- users have no admin privileges
- 'LimitedOperatorUI' is disabled, so users have no privileges to mess with network or wireguard config or tunnel state
- all clients have the 'Windows Baseline Security' applied
- each notebook has a unique config file (above example: 20_EPNBLE-04)
- that config has been enabled via wireguard UI (before deployment by an administrative account) and works
- that tunnel works 99%, but sometimes, just sometimes, the tunnel service is gone after reboot
- I can't spot a pattern to which or when a client looses connectivity
- Most clients have no issues whatsoever, but maybe 20% of those clients had the previously described vpn tunnel loss, but until now no client had this issue twice
- WireGuard log doesn't show anything interesting, because that config file is obviously inactive, and after I click 'Activate' the tunnel works instantly

I read (parts of) the source code and tried to understand how 'WireGuardManager' keeps tabs on which of the available vpn config needs to be reestablished after reboot, but I didn't grasp the business logic yet (I'm a longtime Go developer myself, so reading is usually not the issue - but maybe I need another coffee :/).

Hope you have some pointers on how to resolve this.

Cheers
D. Brodbeck