HRESULT 0x80310099 (FVE_E_ENH_PIN_INVALID): meaning and diagnosis

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM) and enhanced PIN. Try using a PIN containing only numerals.

Previous	Next
FVE_E_FIPS_HASH_KDF_NOT_ALLOWED	FVE_E_INVALID_PIN_CHARS

FVE_E_ENH_PIN_INVALID

The exact BitLocker boundary

FVE_E_ENH_PIN_INVALID (0x80310099) identifies the point where the TPM protector could not use the supplied enhanced PIN, commonly because the preboot environment accepts only the basic numeric character set. For FVE_E_ENH_PIN_INVALID, note: A BitLocker key protector wraps access to the volume master key. When diagnosing FVE_E_ENH_PIN_INVALID, remember: TPM, TPM+PIN, startup key, recovery password, password, certificate and Network Unlock protectors have different volume and policy rules; changing one is not the same as decrypting the volume.

For FVE_E_ENH_PIN_INVALID, note: Never capture PINs, passwords or recovery passwords in logs. When diagnosing FVE_E_ENH_PIN_INVALID, remember: IDs, types, policy, call result and attempt counters are sufficient for most diagnosis.

Do not confuse it with a nearby failure

Keep this separate from FVE_E_INVALID_PIN_CHARS, which identifies invalid characters directly before a protector attempt. For FVE_E_ENH_PIN_INVALID, that distinction determines whether the next check belongs to policy, protector inventory, volume geometry, firmware, account escrow or the calling application's buffer contract.

Evidence that distinguishes the condition

For FVE_E_ENH_PIN_INVALID, record effective enhanced-PIN policy, firmware/preboot keyboard support, current PIN protector, keyboard layout and exact characters class without recording the secret. For FVE_E_ENH_PIN_INVALID, keep the full HRESULT and the first method that returned it because later cleanup calls can report a different state.
For FVE_E_ENH_PIN_INVALID, capture manage-bde -status and the protector inventory for the exact volume GUID, not only the drive letter, because letters can change in WinRE, clusters and deployment environments.
Export BitLocker operational events for the FVE_E_ENH_PIN_INVALID failure and note the boot session, caller identity and management source; that evidence separates this BitLocker condition from a generic access or storage error.

manage-bde -protectors -get C:\npowershell -NoProfile -Command "Get-BitLockerVolume C: | Format-List KeyProtector,ProtectionStatus,VolumeStatus"

Safe corrective sequence

For FVE_E_ENH_PIN_INVALID, retry with a numeric PIN or fix the managed enhanced-PIN configuration after confirming preboot input support.
After correcting the FVE_E_ENH_PIN_INVALID prerequisite, refresh protection, conversion and lock state before one controlled retry; a cached UI message is not proof that the FVE_E_ENH_PIN_INVALID condition is still active.
Before a FVE_E_ENH_PIN_INVALID remediation deletes protectors, changes firmware mode, resizes partitions or decrypts a production drive, verify that an independent recovery method is available and escrowed in the intended directory or account.

For FVE_E_ENH_PIN_INVALID, the boundary above identifies which BitLocker state must change before a retry can be meaningful; repeating the call without changing that state only adds noise.

Enhanced PIN support must exist end to end

Windows policy can allow letters and symbols, but the firmware keyboard path must also reproduce those characters before the operating system loads. Layout differences, function-key handling and unsupported preboot input can make an otherwise valid enhanced PIN unusable. This error therefore needs both policy and firmware evidence.

Test with a numeric PIN to isolate the character-path issue, then decide whether enhanced PINs are operationally supportable on that hardware fleet. Do not collect the actual PIN during testing.

State checks specific to FVE_E_ENH_PIN_INVALID

Checkpoint	How to interpret it for FVE_E_ENH_PIN_INVALID
Before the call	Record the target identity and the pre-call key-protector lifecycle state. For FVE_E_ENH_PIN_INVALID, the decisive boundary is that the TPM protector could not use the supplied enhanced PIN, commonly because the preboot environment accepts only the basic numeric character set.
At failure	Preserve effective enhanced-PIN policy, firmware/preboot keyboard support, current PIN protector, keyboard layout and exact characters class without recording the secret. This proves whether FVE_E_ENH_PIN_INVALID came from BitLocker itself or from a wrapper translating another result.
After correction	Retry with a numeric PIN or fix the managed enhanced-PIN configuration after confirming preboot input support. The FVE_E_ENH_PIN_INVALID request should then advance without removing an unrelated recovery route.
After reboot or remount	Recheck protection, conversion and lock state for FVE_E_ENH_PIN_INVALID; a successful management call is incomplete if the next boot cannot unlock the volume.

Verification after the change

For FVE_E_ENH_PIN_INVALID, success means more than the absence of a dialog. Confirm that the condition represented by FVE_E_ENH_PIN_INVALID now matches the intended design, that the protector inventory has not lost an independent recovery route, and that the next reboot or remount can unlock the volume. If the FVE_E_ENH_PIN_INVALID request advances to another HRESULT, record both values in order because that transition reveals the next unmet prerequisite.

References

Reference set for FVE_E_ENH_PIN_INVALID:

Looking for a different code? Search another status or error code.