| Previous | Next |
| FVE_E_DE_OS_VOLUME_NOT_PROTECTED | FVE_E_DE_PROTECTION_NOT_YET_ENABLED |
FVE_E_DE_DEVICE_LOCKEDOUT
The exact BitLocker boundary
FVE_E_DE_DEVICE_LOCKEDOUT (0x803100CA) identifies the point where Device Lock has entered lockout after too many incorrect credential attempts. Note: Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. When diagnosing this result, remember: It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable.
Note: “Encrypted” and “protected” are not synonyms. When diagnosing this result, remember: Compliance normally requires active protectors and recoverable escrow, not merely a completed sector conversion.
Do not confuse it with a nearby failure
Keep this separate from BitLocker TPM recovery caused by measured-boot changes or a PIN-change throttle. That distinction determines whether the next check belongs to policy, protector inventory, volume geometry, firmware, account escrow or the calling application's buffer contract.
Evidence that distinguishes the condition
- record lockout events and timestamps, device-lock policy, credential provider, recovery path and any automation generating repeated attempts. Keep the full HRESULT and the first method that returned it because later cleanup calls can report a different state.
- capture
manage-bde -statusand the protector inventory for the exact volume GUID, not only the drive letter, because letters can change in WinRE, clusters and deployment environments. - Export BitLocker operational events for the result failure and note the boot session, caller identity and management source; that evidence separates this BitLocker condition from a generic access or storage error.
msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"Safe corrective sequence
- use the authorized recovery path, stop repeated credential submissions, and investigate the source before resetting counters or credentials.
- After correcting the result prerequisite, refresh protection, conversion and lock state before one controlled retry; a cached UI message is not proof that the condition is still active.
- Before a this result remediation deletes protectors, changes firmware mode, resizes partitions or decrypts a production drive, verify that an independent recovery method is available and escrowed in the intended directory or account.
The boundary above identifies which BitLocker state must change before a retry can be meaningful; repeating the call without changing that state only adds noise.
Find the source of repeated credential submissions
Device Lockout is an active protective state after repeated incorrect attempts. Interactive users are only one possible source: cached credentials, provisioning software, remote management or a damaged input device can also generate retries. Correlate the lockout time with credential-provider and device-management events instead of assuming a user forgot a password.
Use the authorized recovery route, stop the retrying component and validate the device-lock policy before returning the device to service. Merely waiting or rebooting can reproduce the same lockout if the source continues submitting stale credentials.
State checks specific to the result
| Checkpoint | How to interpret it for it |
|---|---|
| Before the call | Record the target identity and the pre-call automatic Device Encryption state. The decisive boundary is that Device Lock has entered lockout after too many incorrect credential attempts. |
| At failure | Preserve lockout events and timestamps, device-lock policy, credential provider, recovery path and any automation generating repeated attempts. This proves whether it came from BitLocker itself or from a wrapper translating another result. |
| After correction | Use the authorized recovery path, stop repeated credential submissions, and investigate the source before resetting counters or credentials. The request should then advance without removing an unrelated recovery route. |
| After reboot or remount | Recheck protection, conversion and lock state for it; a successful management call is incomplete if the next boot cannot unlock the volume. |
Verification after the change
Success means more than the absence of a dialog. Confirm that the condition represented by it now matches the intended design, that the protector inventory has not lost an independent recovery route, and that the next reboot or remount can unlock the volume. If the request advances to another HRESULT, record both values in order because that transition reveals the next unmet prerequisite.
References
Reference set for it:
- Microsoft: BitLocker CSP reference
- Microsoft: GetProtectionStatus method
- Microsoft: BitLocker drive encryption for OEMs
- Microsoft: BitLocker overview
Looking for a different code? Search another status or error code.