| Previous | Next |
| FVE_E_NO_SUCH_CAPABILITY_ON_TARGET | FVE_E_DE_VOLUME_OPTED_OUT |
FVE_E_DE_PREVENTED_FOR_OS
Where the operation stops
The value 0x803100D1, named FVE_E_DE_PREVENTED_FOR_OS, is returned when automatic Device Encryption is blocked by the current operating-system configuration or eligibility result. It belongs to the automatic Device Encryption part of BitLocker rather than to generic file I/O.
Automatic Device Encryption has stricter end-to-end prerequisites than manual BitLocker. An Auto-DE HRESULT should be reported with the device-encryption support reason and account/escrow state. Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable.
| Question | What to verify |
|---|---|
| Which object failed? | The exact volume GUID, protector GUID, certificate or API target supplied by the caller. |
| Which state matters? | Device Encryption support reasons, policy, account state, firmware/TPM posture, WinRE state and fixed-volume inventory. |
| What is the nearest false lead? | manual BitLocker being administratively disabled; this code belongs to the automatic device-encryption decision. |
Build a minimal diagnostic record
- Record Device Encryption support reasons, policy, account state, firmware/TPM posture, WinRE state and fixed-volume inventory.
Change only the failed prerequisite
correct the reported eligibility blocker or deploy BitLocker explicitly under managed policy if automatic provisioning is not appropriate.
msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"Use the Device Encryption support reason as the starting point
This code is the automatic-provisioning decision for the operating-system installation. System Information can report a Device Encryption Support reason such as firmware, TPM, WinRE, policy or account prerequisites. Capture that reason together with the OS volume state instead of guessing from a single hardware feature.
If the machine does not qualify for automatic enablement, an administrator can still evaluate a managed manual BitLocker deployment. Keep those two deployment models separate in compliance reports.
State checks specific to FVE_E_DE_PREVENTED_FOR_OS
| Stage | How to interpret it |
|---|---|
| Before the call | Record the target identity and the pre-call automatic Device Encryption state. Automatic Device Encryption is blocked by the current operating-system configuration or eligibility result. |
| At failure | Preserve Device Encryption support reasons, policy, account state, firmware/TPM posture, WinRE state and fixed-volume inventory. This proves whether this result came from BitLocker itself or from a wrapper translating another result. |
| After correction | Correct the reported eligibility blocker or deploy BitLocker explicitly under managed policy if automatic provisioning is not appropriate. |
Official documentation
Looking for a different code? Search another status or error code.