Surface Hubs can't access internal sites after January updates.

[Matthew_79]

None of our hubs can access internal sites after Jan 2019 updates. If we factory reset them, they can.

Is anyone else experiencing same issue? Is there a fix?

We have 10 Hubs world wide and all have this issue. We don't use MDM on the Hubs and northing has changed from a networking level.

[#2]

Hi @Matthew_79 

Indeed, a security update that cascaded from Windows in January will cause internal websites not to work. We are working on a fix but there is no ETA at this point. Since this is caused by a security update, it can't be rolled back.

The workaround would be to reset the device, preferably a Cloud Restore which will have the November update. If you have a WSUS server, don't approve the January update until the fix will be released. Otherwise, you can just configure an inexistent WSUS server (https://inexistentWSUS.internal) so that the device will not take the January update. 

Thank you,

Cezar 

[#3]

Hello @Cezar Cretu,

Thank you for your response to Matthew's post. Our organization is also having this issue across our 13 Surface Hubs and have been for at least the last two weeks. Many of our staff's regular meeting functions have been disrupted and we're looking to resolve this as soon as possible.

I understand that you don't have an estimated timeline for a fix yet, but performing a factory reset on all of our devices will need to happen outside of office hours due to the heavy use of our Surface Hubs and would be a significant lift for our small AV team. Any rough estimate of a resolution timeline would be helpful in the decision to do these resets or wait it out until the next update.

Thank you,

Brian

[#4]

Hi @bstauber,

Nobody can say for sure when the fix will be ready. It depends a lot on the behavior and then testing. What I can say is that this is a top priority and we're working hard on this.

Assuming that the fix is ready today (again, assuming, it's still in the works), it will need to be tested, packaged and scheduled for delivery in flighting (Windows Insider Program) which can happen the earliest on 2C (3rd Tuesday of the month, February 19th). If it misses this window, the next one is on 3C (19th of March) You can get it by joining the program here and then add the device to flighting in the FAST ring from Settings - Update and Security - Windows Insider Program.

If everything goes well, it will be released to General Availability after 2 months. Leaving the risk aside of adding all devices to WIP (which we don't recommend as this program is intended for testing the fix only), the AV team still needs to add all the devices manually. 

I do recommend reading this article and see the best solution for you to manage the updates on the Surface Hub

Best regards,

Cezar

[#5]

@Cezar Cretu 

Hello Cezar,

Thank you for your quick and detailed response. It's unfortunate that fix to this will be at least 2 months out.

Are you able to provide or point me to information related to the January security update so we can analyze the risks associated with moving back to the November update? The update list does not mention list the details of the most recent update.

Thanks,

Brian

[#6]

@bstauber 

This update was cascaded from the Windows so it will not be listed under the Surface Hub updates. 

You can read more about the update here

Thanks

Cezar

[#7]

Thank you, Cezar.  Most of our Hubs are functional in daily workflow again!

On one hub, we have encountered an error, after assigning the device account the Sync status stays at Element not found. (0x80070490)  Any idea what this could be?  The account seems to work properly every where else.  No issues testing EWS on https://testconnectivity.microsoft.com/ Office365/ Microsoft Exchange Web Services Connectivity Tests

[#8]

Hello @Matthew_79 

Given the error (PEER_E_NOT_FOUND) might be just a connection issue. Can you test from a different network? Preferably from a mobile hotspot to exclude any firewall configuration, if the Exchange environment allows it. Make sure that the autodiscover DNS records are published correctly.

If this is still present, please open a support case as we need to analyze the logs

Best regards,

Cezar

[#9]

Hello @bstauber, @Matthew_79  

Please note that a partial fix was released yesterday as part of the February update. This is a partial fix as the user will need to hit refresh to navigate to the internal site to make it load. The final fix is scheduled for March update, still subject to change. 

You can read more about the update here KB4487020

Best regards,

Cezar

[#10]

Thanks for the update Cezar!

[#11]

Hello @Cezar Cretu 

Thank you for letting me know! I'll give this a test on one of devices shortly.

Cheers,

Brian