HRESULT 0x803100CA (FVE_E_DE_DEVICE

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

Device Lock has been triggered due to too many incorrect password attempts.

Previous	Next
FVE_E_DE_OS_VOLUME_NOT_PROTECTED	FVE_E_DE_PROTECTION_NOT_YET_ENABLED

FVE_E_DE_DEVICE_LOCKEDOUT

The exact BitLocker boundary

FVE_E_DE_DEVICE_LOCKEDOUT (0x803100CA) identifies the point where Device Lock has entered lockout after too many incorrect credential attempts. For FVE_E_DE_DEVICE_LOCKEDOUT, note: Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. When diagnosing FVE_E_DE_DEVICE_LOCKEDOUT, remember: It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable.

For FVE_E_DE_DEVICE_LOCKEDOUT, note: “Encrypted” and “protected” are not synonyms. When diagnosing FVE_E_DE_DEVICE_LOCKEDOUT, remember: Compliance normally requires active protectors and recoverable escrow, not merely a completed sector conversion.

Do not confuse it with a nearby failure

Keep this separate from BitLocker TPM recovery caused by measured-boot changes or a PIN-change throttle. For FVE_E_DE_DEVICE_LOCKEDOUT, that distinction determines whether the next check belongs to policy, protector inventory, volume geometry, firmware, account escrow or the calling application's buffer contract.

Evidence that distinguishes the condition

For FVE_E_DE_DEVICE_LOCKEDOUT, record lockout events and timestamps, device-lock policy, credential provider, recovery path and any automation generating repeated attempts. For FVE_E_DE_DEVICE_LOCKEDOUT, keep the full HRESULT and the first method that returned it because later cleanup calls can report a different state.
For FVE_E_DE_DEVICE_LOCKEDOUT, capture manage-bde -status and the protector inventory for the exact volume GUID, not only the drive letter, because letters can change in WinRE, clusters and deployment environments.
Export BitLocker operational events for the FVE_E_DE_DEVICE_LOCKEDOUT failure and note the boot session, caller identity and management source; that evidence separates this BitLocker condition from a generic access or storage error.

msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"

Safe corrective sequence

For FVE_E_DE_DEVICE_LOCKEDOUT, use the authorized recovery path, stop repeated credential submissions, and investigate the source before resetting counters or credentials.
After correcting the FVE_E_DE_DEVICE_LOCKEDOUT prerequisite, refresh protection, conversion and lock state before one controlled retry; a cached UI message is not proof that the FVE_E_DE_DEVICE_LOCKEDOUT condition is still active.
Before a FVE_E_DE_DEVICE_LOCKEDOUT remediation deletes protectors, changes firmware mode, resizes partitions or decrypts a production drive, verify that an independent recovery method is available and escrowed in the intended directory or account.

For FVE_E_DE_DEVICE_LOCKEDOUT, the boundary above identifies which BitLocker state must change before a retry can be meaningful; repeating the call without changing that state only adds noise.

Find the source of repeated credential submissions

Device Lockout is an active protective state after repeated incorrect attempts. Interactive users are only one possible source: cached credentials, provisioning software, remote management or a damaged input device can also generate retries. Correlate the lockout time with credential-provider and device-management events instead of assuming a user forgot a password.

Use the authorized recovery route, stop the retrying component and validate the device-lock policy before returning the device to service. Merely waiting or rebooting can reproduce the same lockout if the source continues submitting stale credentials.

State checks specific to FVE_E_DE_DEVICE_LOCKEDOUT

Checkpoint	How to interpret it for FVE_E_DE_DEVICE_LOCKEDOUT
Before the call	Record the target identity and the pre-call automatic Device Encryption state. For FVE_E_DE_DEVICE_LOCKEDOUT, the decisive boundary is that Device Lock has entered lockout after too many incorrect credential attempts.
At failure	Preserve lockout events and timestamps, device-lock policy, credential provider, recovery path and any automation generating repeated attempts. This proves whether FVE_E_DE_DEVICE_LOCKEDOUT came from BitLocker itself or from a wrapper translating another result.
After correction	Use the authorized recovery path, stop repeated credential submissions, and investigate the source before resetting counters or credentials. The FVE_E_DE_DEVICE_LOCKEDOUT request should then advance without removing an unrelated recovery route.
After reboot or remount	Recheck protection, conversion and lock state for FVE_E_DE_DEVICE_LOCKEDOUT; a successful management call is incomplete if the next boot cannot unlock the volume.

Verification after the change

For FVE_E_DE_DEVICE_LOCKEDOUT, success means more than the absence of a dialog. Confirm that the condition represented by FVE_E_DE_DEVICE_LOCKEDOUT now matches the intended design, that the protector inventory has not lost an independent recovery route, and that the next reboot or remount can unlock the volume. If the FVE_E_DE_DEVICE_LOCKEDOUT request advances to another HRESULT, record both values in order because that transition reveals the next unmet prerequisite.

References

Reference set for FVE_E_DE_DEVICE_LOCKEDOUT:

Looking for a different code? Search another status or error code.