What does HRESULT 0x803100CB (FVE_E_DE_PROTECTION_NOT_YET_ENABLED) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

Protection has not been enabled on the volume. Enabling protection requires a connected account. If you already have a connected account and are seeing this error, please refer to the event log for more information.

Previous	Next
FVE_E_DE_DEVICE_LOCKEDOUT	FVE_E_INVALID_PIN_CHARS_DETAILED

FVE_E_DE_PROTECTION_NOT_YET_ENABLED

Where the operation stops

The value 0x803100CB, named FVE_E_DE_PROTECTION_NOT_YET_ENABLED, is returned when automatic Device Encryption has provisioned or evaluated the volume but has not enabled active protection, commonly because account-backed recovery escrow is incomplete. It belongs to the automatic Device Encryption part of BitLocker rather than to generic file I/O.

Automatic Device Encryption has stricter end-to-end prerequisites than manual BitLocker. An Auto-DE HRESULT should be reported with the device-encryption support reason and account/escrow state. Automatic Device Encryption is a provisioning and compliance workflow layered on BitLocker. It evaluates platform eligibility, account-backed recovery escrow, all applicable fixed volumes and protection state; failure of Auto-DE does not automatically mean manual BitLocker is unavailable.

Question	What to verify
Which object failed?	The exact volume GUID, protector GUID, certificate or API target supplied by the caller.
Which state matters?	connected-account state, escrow event, protector inventory, encryption/conversion status, device-encryption support reason and policy.
What is the nearest false lead?	protection suspended after previously being enabled; this state has not reached protected operation yet.

Build a minimal diagnostic record

Record connected-account state, escrow event, protector inventory, encryption/conversion status, device-encryption support reason and policy.

Change only the failed prerequisite

complete account connection and recovery-key backup, then verify that protectors transition to enabled.

msinfo32.exe
powershell -NoProfile -Command "Get-BitLockerVolume | Format-Table MountPoint,VolumeType,VolumeStatus,ProtectionStatus"

State checks specific to FVE_E_DE_PROTECTION_NOT_YET_ENABLED

Stage	How to interpret it
Before the call	Record the target identity and the pre-call automatic Device Encryption state. Automatic Device Encryption has provisioned or evaluated the volume but has not enabled active protection, commonly because account-backed recovery escrow is incomplete.
At failure	Preserve connected-account state, escrow event, protector inventory, encryption/conversion status, device-encryption support reason and policy. This proves whether this result came from BitLocker itself or from a wrapper translating another result.
After correction	Complete account connection and recovery-key backup, then verify that protectors transition to enabled.

Official documentation

Looking for a different code? Search another status or error code.