STATUS_FVE_DRY_RUN_FAILED (0XC021001E) – BitLocker key grab failure

I know this error is infuriating — you're trying to turn on BitLocker, you run the pre-check, and boom: STATUS_FVE_DRY_RUN_FAILED (0XC021001E). The system says it can't grab the encryption key. You're stuck before you even start.

This tripped me up the first time too, especially on a fresh Windows 11 Pro 23H2 install. The root cause is almost always TPM misconfiguration or Secure Boot being off. Let's hit the most common culprits first.

1. TPM isn't initialized or is disabled

BitLocker needs a working TPM (Trusted Platform Module) to store the encryption key. If the TPM is off in BIOS or not initialized in Windows, you'll get error 0XC021001E every time.

How to check:

1. Press Win + R, type tpm.msc, hit Enter.
2. Look at the bottom of the TPM Management window. It should say "The TPM is ready for use." If it says "Compatible TPM cannot be found" or "TPM is not initialized," that's your problem.

Fix it:

1. Restart your PC and enter BIOS/UEFI (usually F2, Del, or F10 during boot).
2. Find the TPM or Security settings. On Dell systems it's under "Security" > "TPM 2.0 Security". On Lenovo it's "Security" > "Security Chip". On ASUS boards it's "Advanced" > "Trusted Computing".
3. Enable TPM and set it to Firmware TPM if you have an AMD CPU (fTPM) or Intel PTT.
4. Save and exit.
5. Boot into Windows, open tpm.msc again. If it still shows uninitialized, click "Action" > "Prepare the TPM". This will clear any existing keys and set it up fresh.

After that, try the BitLocker pre-check again with manage-bde -on -dryrun C: from an admin command prompt. If it passes, you're golden.

2. Secure Boot is turned off

BitLocker's dry run also checks Secure Boot. If it's disabled, the key chain breaks. This is especially common on DIY desktops or after a BIOS update.

How to check:

• Open msinfo32.exe (System Information). Look at "Secure Boot State" — it must say "On".
• If it says "Off", don't enable it blindly. Some older GPUs or expansion cards will cause a boot loop if you flip Secure Boot on without checking compatibility.

Fix it:

1. Enter BIOS again. On most boards, find "Boot" > "Secure Boot". Set it to "Enabled" or "Standard".
2. If you see a "OS Type" option, choose "Windows UEFI Mode" (not "Other OS").
3. Save and exit.
4. Boot back into Windows, verify msinfo32 now shows Secure Boot On.

Real-world trigger: This error pops up most often after a Windows Feature Update (like 23H2 to 24H2) that messes with UEFI variables. Or right after you replace a motherboard without resetting TPM — that's a head-scratcher.

3. TPM firmware version mismatch or old BIOS

Sometimes the TPM is enabled and Secure Boot is on, but the TPM firmware or motherboard BIOS is just old enough to choke on BitLocker's dry run. This one's rare, but I've seen it on older Intel 6th-gen and 7th-gen systems that were updated to Windows 11 via workarounds.

How to check:

• Open tpm.msc. Look at "TPM Manufacturer Information" — if the spec version is 1.2 instead of 2.0, you're stuck. BitLocker on Windows 10/11 requires TPM 2.0.
• Also check your BIOS version against the manufacturer's support page. If it's more than 2 years old, update it.

Fix it:

1. Go to your motherboard or PC vendor's support site (Dell, HP, Lenovo, ASUS, etc.).
2. Download the latest BIOS/UEFI update. Most modern boards let you flash from within the BIOS, no Windows boot needed.
3. Update the TPM firmware if a separate package exists (rare, but check).
4. After the update, re-enter BIOS, re-enable TPM and Secure Boot. Then clear the TPM from Windows (tpm.msc > "Action" > "Clear TPM"). You'll need to restart.
5. Retry the dry run.

If none of this works, you can bypass the dry run entirely by using the -skipdryrun flag: manage-bde -on -skipdryrun C:. But I don't recommend it — the dry run exists to prevent data loss. Use that only if you're absolutely sure your hardware is fine.

Summary table