Fix FVE_E_CANNOT_SET_FVEK_ENCRYPTED (0X8031002D)

Quick Answer

Decrypt the drive completely with manage-bde -off, then re-encrypt with manage-bde -on using the new algorithm. No shortcuts.

Why This Happens

You're seeing FVE_E_CANNOT_SET_FVEK_ENCRYPTED (0X8031002D) because BitLocker's design is intentionally rigid. Once a volume is encrypted with a specific algorithm (AES-128, AES-256, or XTS-AES variants), Windows won't let you change that algorithm or the FVEK (Full Volume Encryption Key) while the drive stays encrypted. This isn't a bug — it's a security guardrail. Microsoft doesn't allow in-place transformations because they'd require decrypting and re-encrypting on the fly, which risks data corruption or partial encryption states.

This usually pops up when you try to enable BitLocker on a drive that's already encrypted with a different cipher, or when Group Policy pushes a new encryption method after the drive was already locked. I've seen it most often in enterprise deployments where a sysadmin applies a new BitLocker policy without first clearing existing encryption.

Fix Steps

1. Decrypt the drive. Open an elevated command prompt (Admin) and run:
   

   manage-bde -off C:

   Replace C: with your drive letter. This process can take hours depending on drive size and speed — plan accordingly. You'll see a progress percentage with manage-bde -status.
2. Wait for full decryption. Don't skip this. Partial decryption will leave you with the same error. Check status with:
   

   manage-bde -status C:

   Look for Conversion Status: Fully Decrypted.
3. Set your encryption method. If you need a specific algorithm (e.g., XTS-AES-256), set it via Group Policy or registry, or use:
   

   manage-bde -on C: -EncryptionMethod XtsAes256

   Valid options: Aes128, Aes256, XtsAes128, XtsAes256.
4. Reboot and confirm encryption starts. Run manage-bde -status again to verify it's encrypting with the new method.

Alternative Fixes When Decrypting Isn't Possible

If the drive is a system volume and you can't decrypt (maybe it's a remote server), you have two options:

• Suspend BitLocker, then resume with new settings. This works in some cases but is risky — suspended protection leaves the drive vulnerable until a reboot. Run:
  

  manage-bde -protectors -disable C:

  Then reconfigure encryption method via policy, then re-enable protectors with manage-bde -protectors -enable C:. I've seen this fail if the FVEK is already locked in, so don't count on it as a first-line fix.
• Wipe and restore from backup. If the data isn't critical and you have a backup, format the volume and start fresh. Faster than decrypting a 2TB drive.

Prevention

Never change BitLocker encryption policies on already-encrypted drives without a planned maintenance window. Before rolling out new Group Policy for encryption methods, audit existing BitLocker volumes with PowerShell:

Get-BitLockerVolume | Select-Object MountPoint, EncryptionMethod, ProtectionStatus

One more thing: if you're using a self-encrypting drive (eDrive), the error's the same, but the fix is different — you may need to clear the TPM or use the drive's own management tool. For standard drives, the decrypt-re-encrypt loop is the only reliable path.