Fix FVE_E_PROTECTION_DISABLED (0X80310021) Clear Key

BitLocker's got a clear key—protection's off. Happens after hardware swaps. You gotta add a real protector and remove the clear key to lock it down again.

Quick answer: Run manage-bde -protectors -add C: -tpm then manage-bde -protectors -delete C: -type RecoveryPassword as admin. That adds a TPM protector and removes the clear key that's killing your encryption.

Here's the deal: That error code 0X80310021 pops up when BitLocker's been left with a "clear key"—basically a protector that's wide open. I saw this last month on a Dell OptiPlex after a motherboard swap. The TPM chip changed, so Windows dropped back to a clear key to keep the drive bootable. But that means anyone with physical access can just unlock the drive—no password, no PIN, nothing. The error message says "All protection mechanisms are effectively disabled," and it's not kidding. Your data's sitting there like an unlocked door.

Here's the fix, step by step. You'll need an admin command prompt—right-click Start, pick "Command Prompt (Admin)" or "Windows PowerShell (Admin)".

Step 1: Check what protectors are on the drive

Type this to see what's going on:

manage-bde -status C:

Look for a line that says "Key Protectors" with "Clear Key" listed. If you see it, that's your problem. Also check for a TPM protector—if it's missing, that's step 2.

Step 2: Add a TPM protector

If the TPM protector's missing, add it back:

manage-bde -protectors -add C: -tpm

This tells BitLocker to use the current TPM chip. On that OptiPlex, the TPM was still there but uninitialized after the swap—this command fixed it. You'll see "Added protector successfully" if it worked.

Step 3: Remove the clear key

Now kill the clear key that's keeping protection off:

manage-bde -protectors -delete C: -type RecoveryPassword

Wait—this deletes ALL recovery passwords, including the clear key. That's what we want. It won't delete TPM or PIN protectors. After this, run manage-bde -status C: again—you should see "Protection On" and no clear key.

If the main fix doesn't work

Sometimes the TPM needs a kick. Open the TPM Management Console (tpm.msc) and check if it's "Ready." If it's not, you might need to clear it in BIOS/UEFI—but that's risky because it'll break any other BitLocker drives. On some Lenovos, I've had to disable and re-enable TPM in the firmware settings, then reboot and re-run step 2.

Another option: If you can't get TPM working, use a password or PIN instead:

manage-bde -protectors -add C: -pw

Then delete the clear key same as step 3. You'll have to type that password every boot, but it's better than no protection.

Prevention tip

To avoid this in the future, after any hardware change that touches the motherboard or TPM, always check BitLocker status before you close the case. Run manage-bde -status C: and look for "Protection On." If it's off, re-add protectors before you leave the machine. And don't store your recovery key on the same drive—print it out or save it to a USB stick. Had a client last month whose entire print queue died because they stored it on the encrypted drive itself—stupid, but it happens.