Forum Discussion

BrunoK1874's avatar
BrunoK1874
Brass Contributor
Jun 12, 2025

SurfaceHub Gen1 violation error at several devices

Following Error occured 2 day's ago on several SurfaceHub Gen1 in our company: SurfaceHub error: secure boot violation invalid signature detected. Check secure boot policy in setup. Solution could ...
p-s-s's avatar
p-s-s
Copper Contributor
Jul 03, 2025

Caution: Use this procedure at your own risk. I’m not responsible for any failures or data loss that may occur.

We got our Surface Hub v1 working again. It took some back and forth with Microsoft because we were receiving errors running the recovery USB. After a while we found out the NVRAMTool.exe was being quarantined by our Antivirus. 

In my case this is basically what we dit to get our HUB working again:

  1. Disconnect all cables except the power cable.
    • Power-off using the rocker switch beside the power cable.
  2. Remove the internal SSD.
  3. Prepare USB #1 (“BOOTME”):
    • Format a USB 2.0 stick as FAT32.
    • Rename its volume label to BOOTME.
    • Insert the BOOTME USB in the bottom USB port under the Microsoft logo.
    • Power-on using the rocker switch beside the power cable.
    • Retreive the automatically generated Manufacturing.bin from the USB after booting the HUB once.
  4. Submit to Microsoft Support:
    • Open a support ticket and upload that Manufacturing.bin.
    • Provide the Hub’s serial number.
  5. Receive & apply signed binary:
    • When Microsoft sends back the signed .bin, copy it (no renaming) to the same BOOTME USB.
    • You will also receive any additional information you need. (If not, ask at least for the instruction video).
  6. Boot Hub to unlock:
    • Insert the BOOTME USB.
    • Power-on using the rocker switch beside the power cable.
    • Wait for on-screen confirmation that the unlock completed. (it will go into manufacturing mode)
  7. Reinsert SSD & initial boot:
    • Shut down via the power rocker.
    • Reinstall the SSD.
    • Power on once—no need to fully load Windows—then shut down again.
  8. Prepare USB #2 (“PPI-INSTALL”):
    • Format a second USB 2.0 stick as FAT32.
    • Rename it PPI-INSTALL.
    • Copy the region-specific recovery files (provided by Microsoft Support) directly onto it.
  9. Recovery USB boot:
    • Remove the internal SSD again.
    • Insert the PPI-INSTALL USB.
    • Power on via the rocker switch.
    • (If prompted, enter the serial number.)
  10. Run the on-screen PowerShell steps exactly—deviating risks bricking the device.
  11. Finalize & reboot:
  • After recovery completes, reinstall the SSD.
  • Power on.
  • If asked, re-enter the serial number.

Watchouts:

  • Make sure your antivirus isn’t quarantining NVRAMTool.exe.
  • USB sticks must be USB 2.0 and FAT32-formatted.
  • Recovery files are region-specific—use the set provided for your region.

Resources