Troubleshoot Microsoft Surface Hub

Troubleshoot common problems, including setup issues, Exchange ActiveSync errors.

The Surface Hub Hardware Diagnostic tool contains interactive tests which allow you to confirm essential functionality of your Hub is working as expected. In addition to testing hardware, the diagnostic can test the resource account to verify that it's configured properly for your environment. If problems are encountered, results can be saved and shared with the Surface Hub Support Team. For usage information, see Using the Surface Hub Hardware Diagnostic Tool to test a device account.

Common issues are listed in the following table, along with causes and possible fixes. The Setup troubleshooting section contains a listing of on-device problems, along with several types of issues that may be encountered during the first-run experience. The Exchange ActiveSync errors section lists common errors the device may encounter when trying to synchronize with a Microsoft Exchange ActiveSync server.

Setup troubleshooting

This section lists causes, and possible fixes to help troubleshoot issues you might find when you set up your Microsoft Surface Hub.

On-device

Possible fixes for issues on the Surface Hub after you've completed the first-run program.

Issue Causes Possible fixes

Not receiving automatic accept/decline messages.

The device account isn't configured to automatically accept/decline messages.

Use PowerShell cmdlet Set-CalendarProcessing $upn -AutomateProcessing AutoAccept.

The device account isn't configured to process external meeting requests.

Use PowerShell cmdlet Set-CalendarProcessing $upn -ProcessExternalMeetingMessages $true.

Calendar isn't showing on the Welcome screen, or message "Appointments of date (no account provisioned)" is being displayed.

No device account is set up on this Surface Hub.

Provision a device account through Settings.

Calendar isn't showing on the Welcome screen or message "Appointments of date (overprovisioned)" is being displayed.

The device account is provisioned on too many devices.

Remove the device account from other devices that it's provisioned to. This can be done using the Exchange admin portal.

Calendar isn't showing on the Welcome screen or message "Appointments of date (invalid credentials)" is being displayed.

The device account's password has expired and is no longer valid.

Update the account's password in Settings. Also see Password management.

Calendar isn't showing on the Welcome screen or message "Appointments of date (account policy)" is being displayed.

The device account is using an invalid ActiveSync policy.

Make sure the device account has an ActiveSync policy where PasswordEnabled == False.

Calendar isn't showing on the Welcome screen or message "Appointments may be out of date" is being displayed.

Exchange isn't enabled.

Enable the device account for Exchange services through Settings. You need to make sure you have the right set of ActiveSync policies and have also installed any necessary certificates for Exchange services to work.

Can't sign in to Skype for Business.

The device account doesn't have a Session Initiation Protocol (SIP) address property.

The account doesn't have a SIP address property and its User Principal Name (UPN) doesn't match the actual SIP address. The account must have its SIP address set, or the SIP address should be added using the Settings app.

Can't log in to Skype for Business.

The device account requires a certificate to authenticate into Skype for Business.

Install the appropriate certificate using provisioning packages.

 

First run

Possible fixes for issues with Surface Hub first-run program.

Issue Causes Possible fixes

Cannot find account when asked for domain and user name.

Domain needs to be the fully qualified domain name (FQDN).

The FQDN should be provided in the domain field.

Device account page, issues for new account settings

Issue Causes Possible fixes

Unable to find the provided account in Microsoft Entra ID.

The provided account's User Principal Name (UPN) has a tenant that can't be reached in Microsoft Entra ID.

Make sure that you have a working Internet connection, and that the device can reach Microsoft Online Services. Make sure the account credentials are entered correctly.

Unable to reach the specified directory.

The provided account domain specifies a domain that can't be reached.

Make sure that you have a working network connection, and that the device can reach the domain controller. Make sure the account credentials are entered correctly. You can also try using the FQDN instead.

Can't autodiscover Exchange server.

The Exchange server isn't configured for autodiscovery.

Enable autodiscovery of the Exchange server for the device account, or enter the account's Exchange server address manually.

Could not discover the SIP address after entering the account credentials.

There was no SIP address entry in Active Directory or Microsoft Entra ID.

Make sure the account is enabled with Skype for Business and has a SIP address. If not, you can enter the SIP address manually into the text box.

Device account page, issues for existing account settings

Issue Causes Error codes Possible fixes

Account couldn't authenticate with the specified credentials.

The account isn't enabled as a user in Active Directory (AD), needs a password to authenticate, or the password is incorrect.

None

Make sure the credentials are entered correctly. Enable the account as a user in AD and add a password, or set the RoomMailboxPassword

.

Error 0x800C0019 is displayed when providing an Exchange server.

The device account requires a certificate to authenticate.

0x800C0019

Install the appropriate certificate using provisioning packages.

Device account credentials aren't valid for the provided Exchange server.

The provided Exchange server isn't where the device account's mailbox is hosted.

None

Make sure you're providing the correct Exchange mail server for the device account.

HTTP time-out while trying to reach Exchange server.

0x80072EE2

Couldn't find the provided Exchange server.

The Exchange server provided couldn't be found.

None

Ensure that you have a working network or Internet connection, and that the Exchange server you provided is correct.

http not supported.

An Exchange server with http:// instead of https:// was provided.

None

Use an Exchange server that uses https.

People land on the page titled "There's a problem with this account" regarding ActiveSync.

 

The ActiveSync policy PasswordEnabled is set to True (or 1).

None

Create a new ActiveSync policy where PasswordEnabled is set to False (or 0), and then apply that policy to the account.

The Surface Hub doesn't have a connection to Exchange.

None

Make sure that you have a working network or Internet connection.

Exchange returns a status code indicating an error.

None

Make sure that you have a working network or Internet connection.

 

First run, Domain join page issues

Issue Causes Possible fixes

When trying to join a domain, an error shows that the account couldn't authenticate using the specified credentials.

The credentials provided aren't capable of joining the specified domain.

Enter correct credentials for an account that exists in the specified domain.

When specifying a group from a domain, an error shows that the group couldn't be found on the domain.

The group may have been removed or no longer exists.

Verify that the group exists within the domain.

First run, Exchange server page

Issue Causes Possible fixes

People land on this page and are asked for the Exchange server address.

The Exchange server isn't configured for autodiscovery.

Enable autodiscovery of the Exchange server for the device account, or enter the account's Exchange server address manually.

First run, On-device issues

Issue Causes Error codes Possible fixes

Can't sync mail/calendar.

The account hasn't allowed the Surface Hub as an allowed device.

0x86000C1C

Add the Surface Hub device ID to the allowed list by setting the ActiveSyncAllowedDeviceIds property for the mailbox.

Exchange ActiveSync errors

This section lists status codes, mapping, user messages, and actions an admin can take to solve Exchange ActiveSync errors.

Hex Code Mapping User-Friendly Message Action admin should take

0x85010002

E_HTTP_DENIED

The password must be updated.

Update the password.

0x80072EFD

WININET_E_CANNOT_CONNECT

Can't connect to the server right now. Wait a while and try again, or check the account settings.

Verify that the server name is correct and reachable. Verify that the device is connected to the network.

0x86000C29

E_NEXUS_STATUS_DEVICE_NOTPROVISIONED (policies don't match)

The account is configured with policies not compatible with Surface Hub.

Disable the PasswordEnabled policy for this account.

We have a bug where we may surface policy errors if the account doesn't receive any server notifications within the policy refresh interval.

0x86000C4C

E_NEXUS_STATUS_MAXIMUMDEVICESREACHED

The account has too many device partnerships.

Delete one or more partnerships on the server.

0x86000C0A

E_NEXUS_STATUS_SERVERERROR_RETRYLATER

Can't connect to the server right now.

Wait until the server comes back online. If the issue persists, reprovision the account.

0x85050003

E_CREDENTIALS_EXPIRED (Credentials have expired and need to be updated)

The password must be updated.

Update the password.

0x8505000D

E_AIRSYNC_RESET_RETRY

Can't connect to the server right now. Wait a while or check the account's settings.

This is normally a transient error but if the issue persists check the number of devices associated with the account and delete some of them if the number is large.

0x86000C16

E_NEXUS_STATUS_USER_HASNOMAILBOX

The mailbox was migrated to a different server.

You should never see this error. If the issue persists, reprovision the account.

0x85010004

E_HTTP_FORBIDDEN

Can't connect to the server right now. Wait a while and try again, or check the account's settings.

Verify the server name to make sure it's correct. If the account is using cert based authentication make sure the certificate is still valid and update it if not.

0x85030028

E_ACTIVESYNC_PASSWORD_OR_GETCERT

The account's password or client certificate are missing or invalid.

Update the password and/or deploy the client certificate.

0x86000C2A

E_NEXUS_STATUS_DEVICE_POLICYREFRESH

The account is configured with policies not compatible with Surface Hub.

Disable the PasswordEnabled policy for this account.

0x85050002

E_CREDENTIALS_UNAVAILABLE

The password must be updated.

Update the password.

0x80072EE2

WININET_E_TIMEOUT

The network doesn't support the minimum idle timeout required to receive server notification, or the server is offline.

Verify that the server is running. Verify the NAT settings.

0x85002004

E_FAIL_ABORT

This error is used to interrupt the hanging sync, and won't be exposed to users. It will be shown in the diagnostic data if you force an interactive sync, delete the account, or update its settings.

Nothing.

0x85010017

E_HTTP_SERVICE_UNAVAIL

Can't connect to the server right now. Wait a while or check the account's settings.

Verify the server name to make sure it's correct. Wait until the server comes back online. If the issue persists, reprovision the account.

0x86000C0D

E_NEXUS_STATUS_MAILBOX_SERVEROFFLINE

Can't connect to the server right now. Wait a while or check the account's settings.

Verify the server name to make sure it's correct. Wait until the server comes back online. If the issue persists, reprovision the account.

0x85030027

E_ACTIVESYNC_GETCERT

The Exchange server requires a certificate.

Import the appropriate EAS certificate on the Surface Hub.

0x86000C2B

E_NEXUS_STATUS_INVALID_POLICYKEY

The account is configured with policies not compatible with Surface Hub.

Disable the PasswordEnabled policy for this account.

We have a bug where we may surface policy errors if the account doesn't receive any server notifications within the policy refresh interval.

0x85010005

E_HTTP_NOT_FOUND

The server name is invalid.

Verify the server name to make sure it's correct. If the issue persists, reprovision the account.

0x85010014

E_HTTP_SERVER_ERROR

Can't connect to the server.

Verify the server name to make sure it's correct. Trigger a sync and, if the issue persists, reprovision the account.

0x80072EE7

WININET_E_NAME_NOT_RESOLVED

The server name or address couldn't be resolved.

Make sure the server name is entered correctly.

0x8007052F

ERROR_ACCOUNT_RESTRICTION

While autodiscovering the Exchange server, a policy is applied that prevents the logged-in user from logging in to the server.

This is a timing issue. Re-verify the account's credentials. Try to reprovision when they're correct.

0x800C0019

INET_E_INVALID_CERTIFICATE

Security certificate required to access this resource is invalid.

Install the correct ActiveSync certificate needed for the provided device account.

0x80072F0D

WININET_E_INVALID_CA

The certificate authority is invalid or is incorrect. Could not autodiscover the Exchange server because a certificate is missing.

Install the correct ActiveSync certificate needed for the provided device account.

0x80004005

E_FAIL

The domain provided couldn't be found. The Exchange server couldn't be autodiscovered and wasn't provided in the settings.

Make sure that the domain entered is the FQDN, and that there's an Exchange server entered in the Exchange server text box.

Contact Support

If you have questions or need help, you can create a support request.