| Previous | Next |
| hrFileOpenReadOnly | WEP_E_FIXED_DATA_NOT_SUPPORTED |
WEP_E_NOT_PROVISIONED_ON_ALL_VOLUMES
The important question is not merely what the text says, but which contract was being evaluated. At this boundary, one or more fixed volumes are not provisioned with the non-Microsoft encryption provider required for EAS/device-encryption compliance.
The contract behind the HRESULT
Windows Encryption Provider integration has separate gates for provider licensing, hardware readiness, volume support, provisioning, active protection, device-lock configuration, and EAS compliance. WEPHOSTSVC events should therefore be read alongside the third-party provider’s own inventory and logs, not as a replacement for them.
Do not collapse this result into a nearby status. A volume can contain no user data and still count as a fixed volume for provider coverage unless explicitly excluded by the contract. Compare lifecycle, identity, caller, and first API.
Diagnostic worksheet
| Preserve before changing state | Diagnostic value |
|---|---|
| Inventory of fixed volumes, provider registration, provisioning state, and exclusions | Tests whether the first boundary moves. |
| OS/data/recovery partitions and whether each is supported by the provider | Pins evidence to one attempt. |
| WEPHOSTSVC/provider events and EAS RequireEncryption result | Separates contract failure from environment. |
| Newly attached or recently created fixed volumes | Creates a stable before/after control. |
The goal is reproducibility, not a full data dump. Prefer object IDs, configuration exports, event correlation, and redacted paths over credentials, cryptographic material, or user content.
Reproduce the boundary safely
- Provision one unsupported test volume and re-run compliance; retain one negative control so that a broad workaround is not mistaken for a root-cause correction.
- Compare provider inventory with Windows fixed-volume enumeration; keep every other input fixed and record the first event that differs from the failing run.
- Remove a temporary volume and verify coverage calculation changes; use a disposable or backed-up environment when the comparison changes boot, security, device, queue, or encryption state.
Do not use repeated retries as the primary test. In this case, a successful later attempt may reflect a new object, refreshed policy, restarted service, different token, or completed background transition, so record exactly what changed between attempts.
Nearby states and false leads
Read the comparison results in this order for third-party encryption provisioning coverage:
| Observed result | Interpretation |
|---|---|
| The minimal or known-good comparison succeeds | The control works; inspect production-specific state. |
| The control fails at the same first operation | The control also fails; inspect host/provider evidence. |
| A new HRESULT marks another boundary | The failure moved to another boundary; diagnose the new status separately rather than treating it as confirmation that the entire operation is fixed. |
Closing the incident
Apply the smallest change that addresses the first rejected condition: Provision every supported fixed volume or document/remove unsupported fixed storage through the provider’s management workflow. Preserve the pre-change configuration or trace.
Close the incident only when all fixed volumes remain protected after reboot, resize, and addition of a new volume, and compliance detects an intentionally unprovisioned control. Repeat under the original identity and state. A different environment is comparison, not proof.
Technical references
The diagnostic boundaries above are grounded in the following Microsoft specifications and API documentation:
- Microsoft Open Specifications: HRESULT values.
- Microsoft: Exchange ActiveSync Policy Engine overview.
- Microsoft: Windows Encryption Provider Host Service.
- Microsoft: EasClientSecurityPolicy.RequireEncryption.
Looking for a different code? Search another status or error code.