HRESULT 0x803100CB (FVE_E_DE_PROTECTION_NOT_YET

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

Protection has not been enabled on the volume. Enabling protection requires a connected account. If you already have a connected account and are seeing this error, please refer to the event log for more information.

Previous	Next
FVE_E_DE_DEVICE_LOCKEDOUT	FVE_E_INVALID_PIN_CHARS_DETAILED

FVE_E_DE_PROTECTION_NOT_YET_ENABLED

Where the operation stops

The value 0x803100CB, named FVE_E_DE_PROTECTION_NOT_YET_ENABLED, is returned when automatic Device Encryption has provisioned or evaluated the volume but has not enabled active protection, commonly because account-backed recovery escrow is incomplete. For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, it belongs to the automatic Device Encryption part of BitLocker rather than to generic file I/O.

For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, note: Automatic Device Encryption has stricter end-to-end prerequisites than manual BitLocker. When diagnosing FVE_E_DE_PROTECTION_NOT_YET_ENABLED, remember: An Auto-DE HRESULT should be reported with the device-encryption support reason and account/escrow state. For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, note: Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. When diagnosing FVE_E_DE_PROTECTION_NOT_YET_ENABLED, remember: It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable.

Question	What to verify
Which object failed?	For `FVE_E_DE_PROTECTION_NOT_YET_ENABLED`, the exact volume GUID, protector GUID, certificate or API target supplied by the caller.
Which state matters?	connected-account state, escrow event, protector inventory, encryption/conversion status, device-encryption support reason and policy.
What is the nearest false lead?	protection suspended after previously being enabled; this state has not reached protected operation yet.

Build a minimal diagnostic record

For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, record connected-account state, escrow event, protector inventory, encryption/conversion status, device-encryption support reason and policy. For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, keep the full HRESULT and the first method that returned it because later cleanup calls can report a different state.
For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, capture manage-bde -status and the protector inventory for the exact volume GUID, not only the drive letter, because letters can change in WinRE, clusters and deployment environments.
Export BitLocker operational events for the FVE_E_DE_PROTECTION_NOT_YET_ENABLED failure and note the boot session, caller identity and management source; that evidence separates this BitLocker condition from a generic access or storage error.

Change only the failed prerequisite

complete account connection and recovery-key backup, then verify that protectors transition to enabled. For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, collect a fresh state snapshot and issue a single retry from the same management layer.

msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"

Do not delete all key protectors, clear a TPM, reformat a partition or decrypt the volume as a generic response to FVE_E_DE_PROTECTION_NOT_YET_ENABLED; those actions affect different trust layers and can destroy the easiest recovery route.

State checks specific to FVE_E_DE_PROTECTION_NOT_YET_ENABLED

Checkpoint	How to interpret it for FVE_E_DE_PROTECTION_NOT_YET_ENABLED
Before the call	Record the target identity and the pre-call automatic Device Encryption state. For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, the decisive boundary is that automatic Device Encryption has provisioned or evaluated the volume but has not enabled active protection, commonly because account-backed recovery escrow is incomplete.
At failure	Preserve connected-account state, escrow event, protector inventory, encryption/conversion status, device-encryption support reason and policy. This proves whether FVE_E_DE_PROTECTION_NOT_YET_ENABLED came from BitLocker itself or from a wrapper translating another result.
After correction	Complete account connection and recovery-key backup, then verify that protectors transition to enabled. The FVE_E_DE_PROTECTION_NOT_YET_ENABLED request should then advance without removing an unrelated recovery route.
After reboot or remount	Recheck protection, conversion and lock state for FVE_E_DE_PROTECTION_NOT_YET_ENABLED; a successful management call is incomplete if the next boot cannot unlock the volume.

Verification after the change

For FVE_E_DE_PROTECTION_NOT_YET_ENABLED, success means more than the absence of a dialog. Confirm that the condition represented by FVE_E_DE_PROTECTION_NOT_YET_ENABLED now matches the intended design, that the protector inventory has not lost an independent recovery route, and that the next reboot or remount can unlock the volume. If the FVE_E_DE_PROTECTION_NOT_YET_ENABLED request advances to another HRESULT, record both values in order because that transition reveals the next unmet prerequisite.

Official documentation

Reference set for FVE_E_DE_PROTECTION_NOT_YET_ENABLED:

Looking for a different code? Search another status or error code.