| Previous | Next |
| FVE_E_POLICY_CONFLICT_RDV_RK_OFF_AUK_ON | FVE_E_POLICY_PROHIBITS_SELFSIGNED |
FVE_E_NON_BITLOCKER_OID
Enhanced Key Usage restricts certificate purpose
A BitLocker data-recovery-agent or certificate protector can be accepted only when its X.509 extensions permit the intended use. FVE_E_NON_BITLOCKER_OID means an Enhanced Key Usage extension is present, but it does not match the BitLocker object identifier selected by policy.
An absent EKU and a mismatched EKU are not equivalent. BitLocker may permit a certificate without EKU in some configurations, but once the extension is present its purpose identifiers constrain how the certificate can be used. The default BitLocker OID is commonly 1.3.6.1.4.1.311.67.1.1, while organizations can configure another value.
Certificate checks
- Inspect the certificate's EKU extension and compare it with the effective BitLocker policy OID.
- Verify that the intended certificate is selected by thumbprint and that no similarly named certificate was substituted.
- Reissue the certificate with the correct template instead of editing an issued certificate.
- Also check Key Usage, private-key availability, validity period, and trust chain because they produce different failures.
References
- Microsoft: BitLocker recovery certificate requirements
- Microsoft: certificate protector API
- RFC 5280: Extended Key Usage
Looking for a different code? Search another status or error code.