When choosing to decrypt a drive via MBAM, I've noticed a combo box that asks the user to choose a reason for decryption - several possible options are listed including a lost PIN. What's the relevance of asking this question - are the decryption reasons stored somewhere central and possible for administrators to view?
The only reason is: audit.
You can see the reasons in the audit database, using the reports :
By the way, don't forget that support for MBAM 2.5 SP1 will end in April 2026 and will be replaced by Configuration Manager, on-premises.