| Previous | Next |
| STATUS_FVE_VOLUME_TOO_SMALL | STATUS_FVE_FULL_ENCRYPTION_NOT_ALLOWED_ON_TP_STORAGE |
STATUS_FVE_ENH_PIN_INVALID
Meaning and context of STATUS_FVE_ENH_PIN_INVALID
This status belongs to the TPM-and-enhanced-PIN startup path. An enhanced PIN may use more than the numeric character set, but it depends on the related policy and on a preboot input environment that can accept the chosen characters.
Check the configured protector type and the applicable enhanced-PIN policy before assuming that a remembered character sequence is valid for preboot. Keyboard layout, firmware input behavior, and a policy change can matter here in ways that do not affect a normal Windows sign-in password.
Use the approved recovery method if the startup protector cannot release the key, then compare the current PIN policy and boot configuration with the documented deployment baseline. Do not remove every protector before recovery information has been verified.
BitLocker FAQ | manage-bde protectors | TCG TPM specification
Native status interpretation
STATUS_FVE_ENH_PIN_INVALID is 0xC0210031, an NTSTATUS error value. AllStat describes it as “The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM) and enhanced PIN. Try using a PIN containing only numerals.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Compare the exact fve / enh / pin operation on a working system and record differences in object lifetime, access token, device state, negotiated protocol, and policy.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “The BitLocker encryption key could not be obtained from the Trusted Platform Module (TPM) and enhanced PIN. Try using a PIN containing only numerals.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.