| Previous | Next |
| FVE_E_LIVEID_ACCOUNT_BLOCKED | FVE_E_DE_FIXED_DATA_NOT_SUPPORTED |
FVE_E_NOT_PROVISIONED_ON_ALL_VOLUMES
Where the operation stops
The value 0x803100C4, named FVE_E_NOT_PROVISIONED_ON_ALL_VOLUMES, is returned when automatic Device Encryption policy expects all applicable volumes to be provisioned, but at least one required volume is outside the managed encrypted set. It belongs to the automatic Device Encryption part of BitLocker rather than to generic file I/O.
“Encrypted” and “protected” are not synonyms. Compliance normally requires active protectors and recoverable escrow, not merely a completed sector conversion. Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable.
| Question | What to verify |
|---|---|
| Which object failed? | The exact volume GUID, protector GUID, certificate or API target supplied by the caller. |
| Which state matters? | Get-BitLockerVolume output for every fixed volume, volume opt-out state, encryption method, protection status and device-encryption policy. |
| What is the nearest false lead? | a single volume with protection suspended; this condition evaluates device-wide provisioning coverage. |
Build a minimal diagnostic record
- Record Get-BitLockerVolume output for every fixed volume, volume opt-out state, encryption method, protection status and device-encryption policy.
Change only the failed prerequisite
identify the unprovisioned eligible volume and bring it into compliance or document an approved exemption.
msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"State checks specific to FVE_E_NOT_PROVISIONED_ON_ALL_VOLUMES
| Stage | How to interpret it |
|---|---|
| Before the call | Record the target identity and the pre-call automatic Device Encryption state. Automatic Device Encryption policy expects all applicable volumes to be provisioned, but at least one required volume is outside the managed encrypted set. |
| At failure | Preserve Get-BitLockerVolume output for every fixed volume, volume opt-out state, encryption method, protection status and device-encryption policy. This proves whether this result came from BitLocker itself or from a wrapper translating another result. |
| After correction | Identify the unprovisioned eligible volume and bring it into compliance or document an approved exemption. |
Official documentation
Looking for a different code? Search another status or error code.