What does HRESULT 0x803100C8 (FVE_E_DE_PROTECTION_SUSPENDED) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

Protection is enabled on the volume but has been suspended. This is likely to have happened due to an update being applied to your system. Please try again after a reboot.

Previous	Next
FVE_E_DE_WINRE_NOT_CONFIGURED	FVE_E_DE_OS_VOLUME_NOT_PROTECTED

FVE_E_DE_PROTECTION_SUSPENDED

Why this is not a generic disk error

The practical meaning of FVE_E_DE_PROTECTION_SUSPENDED is that Device Encryption is configured but key protectors are temporarily disabled, often for a servicing or firmware transition. The HRESULT is 0x803100C8.

Three decisions before remediation

Is the result target correct?: Use the volume or protector GUID and confirm its role; do not rely only on a drive letter or friendly name.
Is the result request allowed?: Resolve effective policy, Windows edition, caller token and management source for the automatic Device Encryption operation.
Is the result state stable?: Record conversion, protection, lock and reboot status before modifying anything.

Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable. Automatic Device Encryption has stricter end-to-end prerequisites than manual BitLocker. An Auto-DE HRESULT should be reported with the device-encryption support reason and account/escrow state.

Why a common workaround is wrong

This should not be diagnosed as a decrypted or never-provisioned volume; encrypted sectors can remain intact while protection is suspended. That nearby condition needs a different corrective action and may produce a similar user-facing message.

Confirm the returning layer

Record GetProtectionStatus, reboot count for suspension, servicing history, protector list, conversion state and pending reboot state.

msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"

State checks specific to FVE_E_DE_PROTECTION_SUSPENDED

Stage	How to interpret it
Before the call	Record the target identity and the pre-call automatic Device Encryption state. Device Encryption is configured but key protectors are temporarily disabled, often for a servicing or firmware transition.
At failure	Preserve GetProtectionStatus, reboot count for suspension, servicing history, protector list, conversion state and pending reboot state.
After correction	Complete the maintenance reboot and re-enable protectors, then confirm protection is on rather than only encryption completed.

References

Looking for a different code? Search another status or error code.