| Previous | Next |
| FVE_E_FIPS_HASH_KDF_NOT_ALLOWED | FVE_E_INVALID_PIN_CHARS |
FVE_E_ENH_PIN_INVALID
The exact BitLocker condition
FVE_E_ENH_PIN_INVALID (0x80310099) identifies the point where the TPM protector could not use the supplied enhanced PIN, commonly because the preboot environment accepts only the basic numeric character set. A BitLocker key protector wraps access to the volume master key. TPM, TPM+PIN, startup key, recovery password, password, certificate and Network Unlock protectors have different volume and policy rules; changing one is not the same as decrypting the volume.
Never capture PINs, passwords or recovery passwords in logs. IDs, types, policy, call result and attempt counters are sufficient for most diagnosis.
Do not confuse it with a nearby failure
Keep this separate from FVE_E_INVALID_PIN_CHARS, which identifies invalid characters directly before a protector attempt. That distinction determines whether the next check belongs to policy, protector inventory, volume geometry, firmware, account escrow or the calling application's buffer contract.
Evidence that distinguishes the condition
- Record effective enhanced-PIN policy, firmware/preboot keyboard support, current PIN protector, keyboard layout and exact characters class without recording the secret.
manage-bde -protectors -get C:
powershell -NoProfile -Command "Get-BitLockerVolume C: | Format-List KeyProtector,ProtectionStatus,VolumeStatus"Enhanced PIN support must exist end to end
Windows policy can allow letters and symbols, but the firmware keyboard path must also reproduce those characters before the operating system loads. Layout differences, function-key handling and unsupported preboot input can make an otherwise valid enhanced PIN unusable. This error therefore needs both policy and firmware evidence.
Test with a numeric PIN to isolate the character-path issue, then decide whether enhanced PINs are operationally supportable on that hardware fleet. Do not collect the actual PIN during testing.
State checks specific to FVE_E_ENH_PIN_INVALID
| Stage | How to interpret it |
|---|---|
| Before the call | Record the target identity and the pre-call key-protector lifecycle state. The TPM protector could not use the supplied enhanced PIN, commonly because the preboot environment accepts only the basic numeric character set. |
| At failure | Preserve effective enhanced-PIN policy, firmware/preboot keyboard support, current PIN protector, keyboard layout and exact characters class without recording the secret. |
| After correction | Retry with a numeric PIN or fix the managed enhanced-PIN configuration after confirming preboot input support. |
References
Looking for a different code? Search another status or error code.