This article applies only to client systems managed by an Enterprise Server.

When starting Full Disk Encryption the command returns a failed alert once it has been processed by the client workstation.

If the workstations Full Disk Encryption status is viewed the error details that the "operation is forbidden on this workstation (0xC00B0012)".

This will occur if the machines Workstation Policy has had the Prevent Full Disk Encryption option set to Yes.

To resolve this:

• Select the Workstation Policy tab of the team containing the workstation.
• Scroll to the Full Disk Encryption\Prevent Full Disk Encryption option.
• Click the Details button.
• Modify the setting to be No.
• Click OK.

• Select the Workstations tab.
• Select the Workstation in the list you wish to update (it should now have a red coloured icon).
• Click the Update Policy button.
• The new setting will apply to the client overtime and the machines icon colour will return to normal.  To speed up this process please see this article: How do I manually synchronise the Enterprise Server and DESlock+ client?
• Once the client workstation is updated restart Windows on the workstation to allow the change to take effect.
• You can now send the start Full Disk Encryption command again from the Enterprise Server.

 Keywords: FDE, Full Disk Encryption, Start, forbidden