The Agent cannot decrypt its settings files and needs to be approved on the Management Console

The error was introduced in Resilio Connect v3.6 and refers to Agent's attempt to always keep vital data encrypted on disk. The error may appear in 2 places:

• On the "Pending approval" dialog
  It happens when the Agent does not have a valid bootstrap token to be automatically approved by Management Console and receive the vital information (like job keys) that it lost due to decryption problem. This affect the Agents that are connected to the Management Console without configuration file.
  Until approved, the Agent will be offline in the global list of Agents and won't participate in any jobs.
• As an error on a job, with error code SE_CONFIG_DECRYPT_FAILED
  It happens when the Agent is connected to the MC using a configuration file with the valid bootstrap token. This error means that there was something wrong with the OS security provider. However, the Agent was automatically re-authenticated on the MC and received all information it failed to decrypt from the Management Console, so it's already fully functional. 

Typical scenarios when the error appears and ways to resolve

• Agent was migrated from one server to another. 
  Reason: New server's security provider has no keys that the  Agent was using to encrypt its storage.
  Solution: The Agent shall be approved on MC, as described above, and it will store keys in local security provider.
• Admin changed user account for the service of Agent or Management Console.
  Reason: Security provider is user-specific and therefore the Agent running under a different account has no access to keys.
  Solution: Approve / restart the Agent and it will store keys in local security provider.
• No clear reason, and error appears on every restart of the Agent.
  Reason: There is no local security provider on the host where the Agent runs, so the Agent cannot store keys securely. Usually it happens on VMs, docker containers / kubernetes pods, some older NAS models.
  Solution: set environment variable RESILIO_KEY to any password you like and ensure this env var reaches the agent process (may require OS reboot).

Error code SE_CONFIG_DECRYPT_FAILED