HRESULT 0x803100CD (FVE_E_DEVICE_LOCKOUT_COUNTER

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

BitLocker cannot use hardware replay protection because no counter is available on your PC.

Previous	Next
FVE_E_INVALID_PIN_CHARS_DETAILED	FVE_E_DEVICELOCKOUT_COUNTER_MISMATCH

FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE

What BitLocker has already established

At HRESULT 0x803100CD, BitLocker has determined that BitLocker requested a hardware-backed replay or lockout counter, but the platform exposes no usable counter. The FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE code does not by itself say that the volume master key is lost or that user data is corrupt.

Operational boundary: automatic Device Encryption.

For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, note: Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. When diagnosing FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, remember: It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable. For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, note: “Encrypted” and “protected” are not synonyms. When diagnosing FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, remember: Compliance normally requires active protectors and recoverable escrow, not merely a completed sector conversion.

Data to preserve before changing state

For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, record TPM/platform capability, firmware version, device-encryption support reason, counter-provider events and requested lockout policy. For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, keep the full HRESULT and the first method that returned it because later cleanup calls can report a different state.
For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, capture manage-bde -status and the protector inventory for the exact volume GUID, not only the drive letter, because letters can change in WinRE, clusters and deployment environments.
Export BitLocker operational events for the FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE failure and note the boot session, caller identity and management source; that evidence separates this BitLocker condition from a generic access or storage error.

Related state to rule out

Do not merge this incident with a counter mismatch after a counter exists; this platform cannot supply the capability at all. If both appear with FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE in one trace, preserve ordering because the first HRESULT normally identifies the prerequisite that caused later cleanup or fallback messages.

How to retest without losing evidence

Update supported firmware if a counter should exist or use a policy design that does not depend on unavailable hardware replay protection.

After correcting the FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE prerequisite, refresh protection, conversion and lock state before one controlled retry; a cached UI message is not proof that the FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE condition is still active.
Before a FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE remediation deletes protectors, changes firmware mode, resizes partitions or decrypts a production drive, verify that an independent recovery method is available and escrowed in the intended directory or account.

msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"

For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, diagnosis should be driven by the target object, effective policy and captured state snapshot rather than by a generic remediation applied to every BitLocker error.

State checks specific to FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE

Checkpoint	How to interpret it for FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE
Before the call	Record the target identity and the pre-call automatic Device Encryption state. For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, the decisive boundary is that BitLocker requested a hardware-backed replay or lockout counter, but the platform exposes no usable counter.
At failure	Preserve TPM/platform capability, firmware version, device-encryption support reason, counter-provider events and requested lockout policy. This proves whether FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE came from BitLocker itself or from a wrapper translating another result.
After correction	Update supported firmware if a counter should exist or use a policy design that does not depend on unavailable hardware replay protection. The FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE request should then advance without removing an unrelated recovery route.
After reboot or remount	Recheck protection, conversion and lock state for FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE; a successful management call is incomplete if the next boot cannot unlock the volume.

Verification after the change

For FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE, success means more than the absence of a dialog. Confirm that the condition represented by FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE now matches the intended design, that the protector inventory has not lost an independent recovery route, and that the next reboot or remount can unlock the volume. If the FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE request advances to another HRESULT, record both values in order because that transition reveals the next unmet prerequisite.

Microsoft references

Reference set for FVE_E_DEVICE_LOCKOUT_COUNTER_UNAVAILABLE:

Looking for a different code? Search another status or error code.