| Previous | Next |
| FVE_E_DE_OS_VOLUME_NOT_PROTECTED | FVE_E_DE_PROTECTION_NOT_YET_ENABLED |
FVE_E_DE_DEVICE_LOCKEDOUT
The exact BitLocker condition
FVE_E_DE_DEVICE_LOCKEDOUT (0x803100CA) identifies the point where Device Lock has entered lockout after too many incorrect credential attempts. Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable.
“Encrypted” and “protected” are not synonyms. Compliance normally requires active protectors and recoverable escrow, not merely a completed sector conversion.
Do not confuse it with a nearby failure
Keep this separate from BitLocker TPM recovery caused by measured-boot changes or a PIN-change throttle. That distinction determines whether the next check belongs to policy, protector inventory, volume geometry, firmware, account escrow or the calling application's buffer contract.
Evidence that distinguishes the condition
msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"Safe corrective sequence
- Use the authorized recovery path, stop repeated credential submissions, and investigate the source before resetting counters or credentials.
Find the source of repeated credential submissions
Device Lockout is an active protective state after repeated incorrect attempts. Interactive users are only one possible source: cached credentials, provisioning software, remote management or a damaged input device can also generate retries. Correlate the lockout time with credential-provider and device-management events instead of assuming a user forgot a password.
Use the authorized recovery route, stop the retrying component and validate the device-lock policy before returning the device to service. Merely waiting or rebooting can reproduce the same lockout if the source continues submitting stale credentials.
State checks specific to FVE_E_DE_DEVICE_LOCKEDOUT
| Stage | How to interpret it |
|---|---|
| Before the call | Record the target identity and the pre-call automatic Device Encryption state. Device Lock has entered lockout after too many incorrect credential attempts. |
| At failure | Preserve lockout events and timestamps, device-lock policy, credential provider, recovery path and any automation generating repeated attempts. |
References
Looking for a different code? Search another status or error code.