Fix BitLocker FVE_E_PROTECTOR_EXISTS 0X80310031 Error

Yeah, getting the 0X80310031 error is annoying, especially when you're trying to enable BitLocker and it just refuses. The message says a key protector already exists, but you didn't put one there on purpose. Let's fix it without wiping the drive.

The Direct Fix: Delete the Orphaned TPM Protector

This error pops up when you've already got a TPM protector on the volume, even if you can't see it in the GUI. The quickest way is to use the command line. Don't worry, it's not scary.

Open Command Prompt as Administrator. Press the Windows key, type cmd, right-click Command Prompt, and choose Run as administrator. Accept the UAC prompt.

Now run this command to list all protectors on the C: drive:

manage-bde -protectors -get C:

You'll see output like this:

Volume C: []
All Key Protectors

    ID: {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}
    PCR Validation Profile:
    0, 2, 4, 8, 9, 10, 11
    Numerical Password:
      ID: {B2C3D4E5-F6A7-8901-BCDE-F12345678901}

Look for the Numerical Password protector — that's your recovery key. You'll need that ID later. Write it down or copy it.

Now delete the TPM protector. You need the exact ID of the TPM protector from the list. In the example above, the TPM protector ID is {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}. Run this:

manage-bde -protectors -delete C: -id {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}

If you're not sure which one is the TPM protector, you can delete all protectors at once — but only if you have the recovery key backed up. If you haven't backed it up, stop here and save that recovery key to a file or your Microsoft account first. Once you're sure, run:

manage-bde -protectors -delete C: -type RecoveryPassword

Wait, that deletes the recovery password, not all. To nuke everything, run:

manage-bde -protectors -delete C: -type TPM

That removes just the TPM protector. After it's gone, add it back fresh:

manage-bde -protectors -add C: -TPM

Now you should be able to enable BitLocker normally. Go to Control Panel > BitLocker Drive Encryption and click Turn on BitLocker. It should work.

What you'll see: After running the delete command, you'll get a confirmation message: "Protectors deleted successfully." After adding the new TPM protector, you'll see "Key protector added."

Why This Happens

The 0X80310031 error means Windows thinks a TPM protector is already registered on that volume. This can happen if BitLocker was partially enabled and then disabled without cleaning up properly. Or if you ran a script that added a protector manually. The TPM holds a unique key for that volume, and if it's already there, BitLocker refuses to add another.

Deleting and re-adding the TPM protector clears the old registration. The system then thinks it's a fresh volume and lets you proceed.

Less Common Variations

Sometimes the error shows up when you try to add a recovery password protector to a drive that already has one. The fix is the same: delete the duplicate protector type and add it again.

For example, if you get the error when adding a recovery password (Numerical Password), run:

manage-bde -protectors -delete C: -type RecoveryPassword

Then add it back:

manage-bde -protectors -add C: -RecoveryPassword

Another variation: the error occurs on an external USB drive. Replace C: with the drive letter of the USB. For example, if it's F:, use:

manage-bde -protectors -delete F: -type TPM

Note: External drives usually don't use TPM protectors, so the error there is rarer but can happen if you're using a TPM with a USB drive on some enterprise setups.

If you're on Windows 10 1803 or earlier, there was a bug where the GUI would show the error even after a clean install. The command-line fix still works there.

Preventing This Going Forward

Don't manually add protectors using manage-bde -protectors -add unless you really know what you're doing. If you're enabling BitLocker through the GUI, let it handle all the protectors automatically. That's what it's designed for.

Also, if you ever need to disable BitLocker, always use the full Decrypt option in the Control Panel, not just Suspend. Suspending leaves the protectors in place and can cause this error later when you re-enable it. To fully decrypt, right-click the drive in BitLocker settings and choose Turn off BitLocker. Wait for the decryption to finish — it might take a while on large drives.

Finally, back up your recovery key to your Microsoft account or a safe place before you start messing with protectors. If something goes wrong, you'll need that key to unlock the drive.