What does NTSTATUS 0xC0210015 (STATUS_FVE_KEYFILE_NO_VMK) mean?

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

the supplied external protector did not yield the volume master key needed to unlock the volume

Previous	Next
STATUS_FVE_KEYFILE_INVALID	STATUS_FVE_TPM_DISABLED

STATUS_FVE_KEYFILE_NO_VMK

Meaning and context of STATUS_FVE_KEYFILE_NO_VMK

BitLocker was able to process the supplied startup or recovery material far enough to determine that it did not provide the required volume master key. This is different from a missing file and from a visibly malformed file.

Treat the result as a protector-to-volume mismatch until proven otherwise. Check the recovery-key identifier and the volume identity, then use the recovery record registered for that specific encrypted volume. A valid file from another device cannot unwrap this volume’s master key.

Do not disable BitLocker protection or change TPM settings as a shortcut. The next diagnostic question is which protector was expected for this volume and why it no longer resolves to the stored master key.

BitLocker planning guide | BitLocker recovery overview | manage-bde protectors reference

Native status interpretation

STATUS_FVE_KEYFILE_NO_VMK is 0xC0210015, an NTSTATUS error value. AllStat describes it as “The BitLocker encryption key could not be obtained from the startup key or recovery password.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.

Debugging sequence

Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
Log the operation associated with fve / keyfile / vmk, the object or handle type, process and thread identity, and the state transition immediately before the return.
For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.

Recovery considerations

A retry is appropriate only after the owner of this result has changed the state described by “The BitLocker encryption key could not be obtained from the startup key or recovery password.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.

Looking for a different code? Search another status or error code.