diff --git a/cmd/fscrypt/commands.go b/cmd/fscrypt/commands.go
index 27af06cd..3e0e8afc 100644
--- a/cmd/fscrypt/commands.go
+++ b/cmd/fscrypt/commands.go
@@ -992,7 +992,10 @@ func addProtectorAction(c *cli.Context) error {
 		return newExitError(c, err)
 	}
 	// Sanity check before unlocking everything
-	if err := policy.AddProtector(protector); err != nil && errors.Cause(err) != actions.ErrLocked {
+	if err := policy.AddProtector(protector); errors.Cause(err) != actions.ErrLocked {
+		if err == nil {
+                    err = errors.New("policy and protector are not locked!")
+            	}
 		return newExitError(c, err)
 	}