| Previous | Next |
| WEP_E_NO_LICENSE | WEP_E_UNEXPECTED_FAIL |
WEP_E_OS_NOT_PROTECTED
The important question is not merely what the text says, but which contract was being evaluated. At this boundary, the non-Microsoft provider does not report the Windows operating-system drive as actively protected.
Where the failure sits
Windows Encryption Provider integration has separate gates for provider licensing, hardware readiness, volume support, provisioning, active protection, device-lock configuration, and EAS compliance. WEPHOSTSVC events should therefore be read alongside the third-party provider’s own inventory and logs, not as a replacement for them.
Do not collapse this result into a nearby status. Other fixed volumes being protected cannot compensate for an unprotected OS volume when device encryption is required. Compare lifecycle, identity, caller, and first API.
Facts to collect first
| Incident evidence | Question it answers |
|---|---|
| OS volume identity, provider protection state, encryption progress, and key protectors | Tests whether the first boundary moves. |
| Boot mode, recovery environment, and preboot authentication state | Pins evidence to one attempt. |
| Provider/WEPHOSTSVC events and EAS RequireEncryption result | Separates contract failure from environment. |
| Whether protection is pending, suspended, failed, or never provisioned | Creates a stable before/after control. |
Collect the smallest evidence set that identifies the attempt and object. Redact secrets and message contents; preserve hashes, IDs, policy values, versions, and state transitions instead.
Change one variable at a time
- Query provider status after a full reboot rather than only during conversion; keep every other input fixed and record the first event that differs from the failing run.
- Compare a protected data volume with the OS volume; use a disposable or backed-up environment when the comparison changes boot, security, device, queue, or encryption state.
- Complete encryption on a lab system and test recovery boot; retain one negative control so that a broad workaround is not mistaken for a root-cause correction.
One clean comparison is more informative than many uncontrolled retries. For the controlled comparison, keep the original inputs and identity, change a single suspected condition, and stop as soon as the first differing event is visible.
What the result does not prove
Interpret the controlled tests as evidence about the returning boundary:
| Observed result | Interpretation |
|---|---|
| The minimal or known-good comparison succeeds | The control works; inspect production-specific state. |
| The control fails at the same first operation | The control also fails; inspect host/provider evidence. |
| A new HRESULT marks another boundary | The failure moved to another boundary; diagnose the new status separately rather than treating it as confirmation that the entire operation is fixed. |
Verification after correction
Repair the failed contract rather than the surrounding system: Provision and activate OS-volume protection with validated recovery access, then allow conversion and required reboots to finish. Preserve the pre-change configuration or trace.
Close the incident only when the OS drive reports active protection after cold boot, recovery media works, and compliance detects deliberate suspension. Repeat under the original identity and state. A different environment is comparison, not proof.
Technical references
These references define the HRESULT family and subsystem contract used above:
- Microsoft Open Specifications: HRESULT values.
- Microsoft: Exchange ActiveSync Policy Engine overview.
- Microsoft: Windows Encryption Provider Host Service.
- Microsoft: EasClientSecurityPolicy.RequireEncryption.
Looking for a different code? Search another status or error code.