Troubleshoot Microsoft Surface Hub
Troubleshoot common problems, including setup issues, Exchange ActiveSync errors.
The Surface Hub Hardware Diagnostic tool contains interactive tests which allow you to confirm essential functionality of your Hub is working as expected. In addition to testing hardware, the diagnostic can test the resource account to verify that it's configured properly for your environment. If problems are encountered, results can be saved and shared with the Surface Hub Support Team. For usage information, see Using the Surface Hub Hardware Diagnostic Tool to test a device account.
Common issues are listed in the following table, along with causes and possible fixes. The Setup troubleshooting section contains a listing of on-device problems, along with several types of issues that may be encountered during the first-run experience. The Exchange ActiveSync errors section lists common errors the device may encounter when trying to synchronize with a Microsoft Exchange ActiveSync server.
Setup troubleshooting
This section lists causes, and possible fixes to help troubleshoot issues you might find when you set up your Microsoft Surface Hub.
On-device
Possible fixes for issues on the Surface Hub after you've completed the first-run program.
| Issue | Causes | Possible fixes |
|---|---|---|
|
Not receiving automatic accept/decline messages. |
The device account isn't configured to automatically accept/decline messages. |
Use PowerShell cmdlet |
|
The device account isn't configured to process external meeting requests. |
Use PowerShell cmdlet |
|
|
Calendar isn't showing on the Welcome screen, or message "Appointments of date (no account provisioned)" is being displayed. |
No device account is set up on this Surface Hub. |
Provision a device account through Settings. |
|
Calendar isn't showing on the Welcome screen or message "Appointments of date (overprovisioned)" is being displayed. |
The device account is provisioned on too many devices. |
Remove the device account from other devices that it's provisioned to. This can be done using the Exchange admin portal. |
|
Calendar isn't showing on the Welcome screen or message "Appointments of date (invalid credentials)" is being displayed. |
The device account's password has expired and is no longer valid. |
Update the account's password in Settings. Also see Password management. |
|
Calendar isn't showing on the Welcome screen or message "Appointments of date (account policy)" is being displayed. |
The device account is using an invalid ActiveSync policy. |
Make sure the device account has an ActiveSync policy where |
|
Calendar isn't showing on the Welcome screen or message "Appointments may be out of date" is being displayed. |
Exchange isn't enabled. |
Enable the device account for Exchange services through Settings. You need to make sure you have the right set of ActiveSync policies and have also installed any necessary certificates for Exchange services to work. |
|
Can't sign in to Skype for Business. |
The device account doesn't have a Session Initiation Protocol (SIP) address property. |
The account doesn't have a SIP address property and its User Principal Name (UPN) doesn't match the actual SIP address. The account must have its SIP address set, or the SIP address should be added using the Settings app. |
|
Can't log in to Skype for Business. |
The device account requires a certificate to authenticate into Skype for Business. |
Install the appropriate certificate using provisioning packages. |
First run
Possible fixes for issues with Surface Hub first-run program.
| Issue | Causes | Possible fixes |
|---|---|---|
Cannot find account when asked for domain and user name. |
Domain needs to be the fully qualified domain name (FQDN). |
The FQDN should be provided in the domain field. |
Device account page, issues for new account settings
| Issue | Causes | Possible fixes |
|---|---|---|
Unable to find the provided account in Microsoft Entra ID. |
The provided account's User Principal Name (UPN) has a tenant that can't be reached in Microsoft Entra ID. |
Make sure that you have a working Internet connection, and that the device can reach Microsoft Online Services. Make sure the account credentials are entered correctly. |
Unable to reach the specified directory. |
The provided account domain specifies a domain that can't be reached. |
Make sure that you have a working network connection, and that the device can reach the domain controller. Make sure the account credentials are entered correctly. You can also try using the FQDN instead. |
Can't autodiscover Exchange server. |
The Exchange server isn't configured for autodiscovery. |
Enable autodiscovery of the Exchange server for the device account, or enter the account's Exchange server address manually. |
Could not discover the SIP address after entering the account credentials. |
There was no SIP address entry in Active Directory or Microsoft Entra ID. |
Make sure the account is enabled with Skype for Business and has a SIP address. If not, you can enter the SIP address manually into the text box. |
Device account page, issues for existing account settings
| Issue | Causes | Error codes | Possible fixes |
|---|---|---|---|
|
Account couldn't authenticate with the specified credentials. |
The account isn't enabled as a user in Active Directory (AD), needs a password to authenticate, or the password is incorrect. |
None |
Make sure the credentials are entered correctly. Enable the account as a user in AD and add a password, or set the RoomMailboxPassword . |
|
Error 0x800C0019 is displayed when providing an Exchange server. |
The device account requires a certificate to authenticate. |
0x800C0019 |
Install the appropriate certificate using provisioning packages. |
|
Device account credentials aren't valid for the provided Exchange server. |
The provided Exchange server isn't where the device account's mailbox is hosted. |
None |
Make sure you're providing the correct Exchange mail server for the device account. |
|
HTTP time-out while trying to reach Exchange server. |
0x80072EE2 |
||
|
Couldn't find the provided Exchange server. |
The Exchange server provided couldn't be found. |
None |
Ensure that you have a working network or Internet connection, and that the Exchange server you provided is correct. |
|
http not supported. |
An Exchange server with http:// instead of https:// was provided. |
None |
Use an Exchange server that uses https. |
|
People land on the page titled "There's a problem with this account" regarding ActiveSync. |
The ActiveSync policy PasswordEnabled is set to True (or 1). |
None |
Create a new ActiveSync policy where PasswordEnabled is set to False (or 0), and then apply that policy to the account. |
|
The Surface Hub doesn't have a connection to Exchange. |
None |
Make sure that you have a working network or Internet connection. |
|
|
Exchange returns a status code indicating an error. |
None |
Make sure that you have a working network or Internet connection. |
First run, Domain join page issues
| Issue | Causes | Possible fixes |
|---|---|---|
When trying to join a domain, an error shows that the account couldn't authenticate using the specified credentials. |
The credentials provided aren't capable of joining the specified domain. |
Enter correct credentials for an account that exists in the specified domain. |
When specifying a group from a domain, an error shows that the group couldn't be found on the domain. |
The group may have been removed or no longer exists. |
Verify that the group exists within the domain. |
First run, Exchange server page
| Issue | Causes | Possible fixes |
|---|---|---|
People land on this page and are asked for the Exchange server address. |
The Exchange server isn't configured for autodiscovery. |
Enable autodiscovery of the Exchange server for the device account, or enter the account's Exchange server address manually. |
First run, On-device issues
| Issue | Causes | Error codes | Possible fixes |
|---|---|---|---|
Can't sync mail/calendar. |
The account hasn't allowed the Surface Hub as an allowed device. |
0x86000C1C |
Add the Surface Hub device ID to the allowed list by setting the ActiveSyncAllowedDeviceIds property for the mailbox. |
Exchange ActiveSync errors
This section lists status codes, mapping, user messages, and actions an admin can take to solve Exchange ActiveSync errors.
| Hex Code | Mapping | User-Friendly Message | Action admin should take |
|---|---|---|---|
0x85010002 |
E_HTTP_DENIED |
The password must be updated. |
Update the password. |
0x80072EFD |
WININET_E_CANNOT_CONNECT |
Can't connect to the server right now. Wait a while and try again, or check the account settings. |
Verify that the server name is correct and reachable. Verify that the device is connected to the network. |
0x86000C29 |
E_NEXUS_STATUS_DEVICE_NOTPROVISIONED (policies don't match) |
The account is configured with policies not compatible with Surface Hub. |
Disable the PasswordEnabled policy for this account. We have a bug where we may surface policy errors if the account doesn't receive any server notifications within the policy refresh interval. |
0x86000C4C |
E_NEXUS_STATUS_MAXIMUMDEVICESREACHED |
The account has too many device partnerships. |
Delete one or more partnerships on the server. |
0x86000C0A |
E_NEXUS_STATUS_SERVERERROR_RETRYLATER |
Can't connect to the server right now. |
Wait until the server comes back online. If the issue persists, reprovision the account. |
0x85050003 |
E_CREDENTIALS_EXPIRED (Credentials have expired and need to be updated) |
The password must be updated. |
Update the password. |
0x8505000D |
E_AIRSYNC_RESET_RETRY |
Can't connect to the server right now. Wait a while or check the account's settings. |
This is normally a transient error but if the issue persists check the number of devices associated with the account and delete some of them if the number is large. |
0x86000C16 |
E_NEXUS_STATUS_USER_HASNOMAILBOX |
The mailbox was migrated to a different server. |
You should never see this error. If the issue persists, reprovision the account. |
0x85010004 |
E_HTTP_FORBIDDEN |
Can't connect to the server right now. Wait a while and try again, or check the account's settings. |
Verify the server name to make sure it's correct. If the account is using cert based authentication make sure the certificate is still valid and update it if not. |
0x85030028 |
E_ACTIVESYNC_PASSWORD_OR_GETCERT |
The account's password or client certificate are missing or invalid. |
Update the password and/or deploy the client certificate. |
0x86000C2A |
E_NEXUS_STATUS_DEVICE_POLICYREFRESH |
The account is configured with policies not compatible with Surface Hub. |
Disable the PasswordEnabled policy for this account. |
0x85050002 |
E_CREDENTIALS_UNAVAILABLE |
The password must be updated. |
Update the password. |
0x80072EE2 |
WININET_E_TIMEOUT |
The network doesn't support the minimum idle timeout required to receive server notification, or the server is offline. |
Verify that the server is running. Verify the NAT settings. |
0x85002004 |
E_FAIL_ABORT |
This error is used to interrupt the hanging sync, and won't be exposed to users. It will be shown in the diagnostic data if you force an interactive sync, delete the account, or update its settings. |
Nothing. |
0x85010017 |
E_HTTP_SERVICE_UNAVAIL |
Can't connect to the server right now. Wait a while or check the account's settings. |
Verify the server name to make sure it's correct. Wait until the server comes back online. If the issue persists, reprovision the account. |
0x86000C0D |
E_NEXUS_STATUS_MAILBOX_SERVEROFFLINE |
Can't connect to the server right now. Wait a while or check the account's settings. |
Verify the server name to make sure it's correct. Wait until the server comes back online. If the issue persists, reprovision the account. |
0x85030027 |
E_ACTIVESYNC_GETCERT |
The Exchange server requires a certificate. |
Import the appropriate EAS certificate on the Surface Hub. |
0x86000C2B |
E_NEXUS_STATUS_INVALID_POLICYKEY |
The account is configured with policies not compatible with Surface Hub. |
Disable the PasswordEnabled policy for this account. We have a bug where we may surface policy errors if the account doesn't receive any server notifications within the policy refresh interval. |
0x85010005 |
E_HTTP_NOT_FOUND |
The server name is invalid. |
Verify the server name to make sure it's correct. If the issue persists, reprovision the account. |
0x85010014 |
E_HTTP_SERVER_ERROR |
Can't connect to the server. |
Verify the server name to make sure it's correct. Trigger a sync and, if the issue persists, reprovision the account. |
0x80072EE7 |
WININET_E_NAME_NOT_RESOLVED |
The server name or address couldn't be resolved. |
Make sure the server name is entered correctly. |
0x8007052F |
ERROR_ACCOUNT_RESTRICTION |
While autodiscovering the Exchange server, a policy is applied that prevents the logged-in user from logging in to the server. |
This is a timing issue. Re-verify the account's credentials. Try to reprovision when they're correct. |
0x800C0019 |
INET_E_INVALID_CERTIFICATE |
Security certificate required to access this resource is invalid. |
Install the correct ActiveSync certificate needed for the provided device account. |
0x80072F0D |
WININET_E_INVALID_CA |
The certificate authority is invalid or is incorrect. Could not autodiscover the Exchange server because a certificate is missing. |
Install the correct ActiveSync certificate needed for the provided device account. |
0x80004005 |
E_FAIL |
The domain provided couldn't be found. The Exchange server couldn't be autodiscovered and wasn't provided in the settings. |
Make sure that the domain entered is the FQDN, and that there's an Exchange server entered in the Exchange server text box. |
Contact Support
If you have questions or need help, you can create a support request.