HRESULT 0x803100BA (FVE_E_SECUREBOOT

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

BitLocker cannot bind platform integrity to PCR 7 because UEFI Secure Boot is currently disabled.

Previous	Next
FVE_E_WIPE_CANCEL_NOT_APPLICABLE	FVE_E_SECUREBOOT_CONFIGURATION_INVALID

FVE_E_SECUREBOOT_DISABLED

Secure Boot state participates in TPM sealing

On compatible UEFI systems, BitLocker can use PCR 7 to bind an operating-system protector to Secure Boot policy rather than to exact measurements of multiple firmware and boot components. FVE_E_SECUREBOOT_DISABLED means this integrity path is unavailable because firmware reports Secure Boot as disabled.

Enabling Secure Boot is not a risk-free toggle on an already protected device. Changing firmware boot mode, trust databases, or signed boot components can change TPM measurements and trigger recovery.

Safe diagnostic sequence

Record the current PCR validation profile with manage-bde -protectors -get.
Check UEFI mode, Secure Boot state, setup/user mode, and the configured signature databases.
Make sure the recovery password is available before changing firmware settings.
After remediation, verify BitLocker-API events and that PCR 7 appears in the protector profile when expected.

References

Looking for a different code? Search another status or error code.