What does HRESULT 0x8031006D (FVE_E_OS_VOLUME_PASSPHRASE_NOT_ALLOWED) mean?

FVE_E_OS_VOLUME_PASSPHRASE_NOT_ALLOWED

Read this as a state-machine result

FVE_E_OS_VOLUME_PASSPHRASE_NOT_ALLOWED is a BitLocker facility HRESULT, not a Win32 filesystem error wrapped by an application. In this case a password protector was requested for the operating-system volume, where that protector type is not supported for preboot authentication.

A BitLocker key protector wraps access to the volume master key. TPM, TPM+PIN, startup key, recovery password, password, certificate and Network Unlock protectors have different volume and policy rules; changing one is not the same as decrypting the volume.

What the code does not prove

The closest misleading interpretation is a fixed or removable data volume password policy; those volumes have different unlock semantics. Verify the returning method and state transition before assigning the incident to disk corruption, TPM failure or bad credentials.

Inspect the target, not just the message

1. Record volume type, requested protector type, current TPM/startup protectors, preboot input capability and effective startup-authentication policy.

A change operation authenticates the old protector and creates replacement wrapping data. An administrator reset follows a different trust path, which is why change and reset errors must not be merged.

manage-bde -protectors -get C:
powershell -NoProfile -Command "Get-BitLockerVolume C: | Format-List KeyProtector,ProtectionStatus,VolumeStatus"

State checks specific to FVE_E_OS_VOLUME_PASSPHRASE_NOT_ALLOWED

References

• Microsoft: manage-bde protectors
• Microsoft: ChangePIN method
• Microsoft: BitLocker recovery overview
• Microsoft: Configure BitLocker policy