| Previous | Next |
| STATUS_FVE_PIN_INVALID | STATUS_FVE_AUTH_INVALID_CONFIG |
STATUS_FVE_AUTH_INVALID_APPLICATION
Meaning and context of STATUS_FVE_AUTH_INVALID_APPLICATION
BitLocker detected a mismatch in a boot application hash used by its validation path. The code is not a generic application-crash result; it is a boot-integrity signal relevant to the protector that guards the OS volume key.
Preserve the recovery path and record recent updates to firmware, boot applications, boot manager, or security policy. Compare this with STATUS_FVE_AUTH_INVALID_CONFIG: that status is about BCD configuration, whereas this one identifies a boot application measurement mismatch.
Do not disable Secure Boot or delete boot entries merely to avoid a recovery prompt. Use recovery to start the system when authorised, then make the intended boot-chain change through the documented deployment or maintenance process.
BitLocker preboot recovery guidance | TCG TPM 2.0 Library | BitLocker recovery overview
Native status interpretation for STATUS_FVE_AUTH_INVALID_APPLICATION
STATUS_FVE_AUTH_INVALID_APPLICATION is 0xC021001B, an NTSTATUS error value. AllStat describes it as “A boot application hash does not match the hash computed when BitLocker was turned on.”. For STATUS_FVE_AUTH_INVALID_APPLICATION, the first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence for STATUS_FVE_AUTH_INVALID_APPLICATION
- Preserve STATUS_FVE_AUTH_INVALID_APPLICATION before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Correlate STATUS_FVE_AUTH_INVALID_APPLICATION with ETW, Event Viewer, protocol traces, or a dump from the component that owns fve / auth / application; do not diagnose from translated text alone.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with STATUS_FVE_AUTH_INVALID_APPLICATION.
Recovery considerations for STATUS_FVE_AUTH_INVALID_APPLICATION
A retry is appropriate only after the owner of STATUS_FVE_AUTH_INVALID_APPLICATION has changed the state described by “A boot application hash does not match the hash computed when BitLocker was turned on.”, or when its contract explicitly marks the status as transient. For STATUS_FVE_AUTH_INVALID_APPLICATION, if the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.