| Previous | Next |
| STATUS_FVE_TPM_INVALID_PCR | STATUS_FVE_PIN_INVALID |
STATUS_FVE_TPM_NO_VMK
Meaning and context of STATUS_FVE_TPM_NO_VMK
The TPM path was selected, but BitLocker could not obtain the volume master key through that protector. It is distinct from STATUS_FVE_TPM_DISABLED, where the TPM is unavailable, and from STATUS_FVE_TPM_INVALID_PCR, which identifies a PCR-validation or temporary lockout condition.
Check the target volume, its registered protectors, TPM availability, and any recent platform-state changes. Then use the approved recovery protector for the correct volume rather than changing the TPM configuration while the unlock reason is still unknown.
Keep the recovery path separate from root-cause analysis. A successful recovery unlock restores access; it does not by itself prove that the TPM protector or the measured boot configuration is again valid for future starts.
BitLocker planning guide | BitLocker preboot recovery guidance | BitLocker recovery overview
Native status interpretation for STATUS_FVE_TPM_NO_VMK
STATUS_FVE_TPM_NO_VMK is 0xC0210019, an NTSTATUS error value. AllStat describes it as “The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM).”. For STATUS_FVE_TPM_NO_VMK, the first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence for STATUS_FVE_TPM_NO_VMK
- Preserve STATUS_FVE_TPM_NO_VMK before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Compare the exact fve / tpm / vmk operation on a working system and record differences in object lifetime, access token, device state, negotiated protocol, and policy.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with STATUS_FVE_TPM_NO_VMK.
Recovery considerations for STATUS_FVE_TPM_NO_VMK
A retry is appropriate only after the owner of STATUS_FVE_TPM_NO_VMK has changed the state described by “The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM).”, or when its contract explicitly marks the status as transient. For STATUS_FVE_TPM_NO_VMK, if the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.