DPAPI is failing in powershell only if entropy is used

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

When I launch powershell from %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe and run a basic script which uses protect and unprotect with entropy, I am getting an error:

Exception calling "Unprotect" with "3" argument(s): "The operation completed successfully

The following is the sample script:

Add-Type -AssemblyName System.Security

$data = [System.Text.Encoding]::UTF8.GetBytes("hello")

$AdditionalEntropy = [System.Text.Encoding]::UTF8.GetBytes("Optional")

$protectedData = [System.Security.Cryptography.ProtectedData]::Protect($data, $AdditionalEntropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)

$protectedDataString = [Convert]::ToBase64String($protectedData)
Write-Host "Protected Data: $protectedDataString"

$AdditionalEntropy2 = [System.Text.Encoding]::UTF8.GetBytes("Optional")

$unprotectedData = [System.Security.Cryptography.ProtectedData]::Unprotect($protectedData, $AdditionalEntropy2, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)

$unprotectedString = [System.Text.Encoding]::UTF8.GetString($unprotectedData)
Write-Host "Unprotected Data: $unprotectedString"

The same script works in powershell ISE. Also if set the entropy to null, it is working in powershell. I am using windows server 2022 with .net 4.8 installed.

Expected behavior

The dpapi protect and unprotect should work in powershell when entropy is not null

Actual behavior

The dpapi protect and unprotect are not working in powershell when entropy is not null

Error details

No response

Environment data

Release      : 528449
PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Ful
               l\1033
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Ful
               l
PSChildName  : 1033
PSProvider   : Microsoft.PowerShell.Core\Registry
 
Major         : 5
Minor         : 1
Build         : 20348
Revision      : 2652
MajorRevision : 0
MinorRevision : 2652

Visuals

No response

Start by running the provided PowerShell script from %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe on the reported Windows Server 2022 and compare it with PowerShell ISE. Investigate the Protect and Unprotect calls using non-null AdditionalEntropy; done means both operations succeed and the script prints the original unprotected value.