Outlook rarely explains a connection problem in plain words: you get a hex code in a Send/Receive dialog, a GetLastError number in the Autodiscover log or a certificate warning. This quick reference lists the codes Exchange Server admins meet most with Outlook, Autodiscover and the offline address book (OAB): the meaning from Microsoft's documentation, the usual on-premises cause and the first thing to check, with links to the detailed guides.
Codes in this quick reference
0x8004010F MAPI_E_NOT_FOUND: object not found (The operation failed. An object could not be found.)Outlook (Download Address Book)0x80190194 BG_E_HTTP_ERROR_404: the OAB download URL does not exist on the serverOutlook (Download Address Book)0x80190191 BG_E_HTTP_ERROR_401: the OAB download requires user authenticationOutlook (Download Address Book)0x80190197 BG_E_HTTP_ERROR_407: the proxy requires user authenticationOutlook (Download Address Book)0x801901F7 BG_E_HTTP_ERROR_503: the service is temporarily overloadedOutlook (Download Address Book)0x801901F8 BG_E_HTTP_ERROR_504: timed out waiting for a gatewayOutlook (Download Address Book)0x8004011D The server is not available. Contact your administrator if this condition persists.Outlook Send/Receive0x80040115 MAPI_E_NETWORK_ERROR: a problem with network operations or servicesOutlook Send/Receive
+ 37 more codes in the tables below.
How to read these codes#
- Send/Receive dialog:
Task '<account>' reported error (0x8004010F) : '...'. The hex code is the part to look up. - Test E-mail AutoConfiguration: Ctrl + right-click the Outlook icon in the notification area. The Log tab lists each Autodiscover attempt with
GetLastError=andhttpStatus=; Connection Status on the same menu shows each connection's server and state. - Server side: the IIS logs (
%SystemDrive%\inetpub\logs\LogFiles\W3SVC1for the front end) and HttpProxy logs (%ExchangeInstallPath%Logging\HttpProxy\<protocol>) show the HTTP status each client received.
| Prefix | Family | Example |
|---|---|---|
0x8004xxxx | MAPI error codes (Microsoft's [MS-OXCDATA] list) | 0x8004010F = MAPI_E_NOT_FOUND |
0x8007xxxx | A Windows error wrapped as an HRESULT: convert the last four hex digits to decimal | 0x80070005 = error 5 (access denied); 0x80072EE7 = 12007 |
0x8019xxxx | BITS (used for OAB downloads) passing on an HTTP status: the last three hex digits in decimal | 0x80190194 = HTTP 404 |
0x800CCCxx | Internet mail accounts (POP3, IMAP4, SMTP) | 0x800CCC0E |
GetLastError=12xxx | Windows internet (WinINet) errors in the Autodiscover log | 12007 = name not resolved |
Offline address book download codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x8004010F | MAPI_E_NOT_FOUND: the requested object could not be found at the server. Outlook shows The operation failed. An object could not be found. | No default OAB, OAB not assigned to the database or mailbox, or not generated yet | Get-MailboxDatabase | fl Name,OfflineAddressBook; OAB guide |
0x80190194 | BG_E_HTTP_ERROR_404: the requested URL does not exist on the server | OAB virtual directory URL wrong or missing, or OAB files not on the server yet | Get-OabVirtualDirectory | fl Server,InternalUrl,ExternalUrl |
0x80190191 | BG_E_HTTP_ERROR_401: the resource requires user authentication | Authentication changed on the OAB virtual directory, or a device in the path breaks Windows authentication | 401s for /OAB in the IIS log; Get-OabVirtualDirectory | fl *Authentication* |
0x80190197 | BG_E_HTTP_ERROR_407: the proxy requires user authentication | The client's web proxy handles the Exchange namespace | Proxy bypass list or PAC file |
0x801901F7 | BG_E_HTTP_ERROR_503: the service is temporarily overloaded | OAB application pool stopped, OabProxy component Inactive, server drained | Get-ServerComponentState; /oab/healthcheck.htm (load balancer guide) |
0x801901F8 | BG_E_HTTP_ERROR_504: timed out waiting for a gateway | Reverse proxy or load balancer timing out towards Exchange | Device timeouts and pool member status |
Outlook Send/Receive and MAPI codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x8004011D | The server is not available. Contact your administrator if this condition persists. | Outlook can't reach the mailbox during Send/Receive. One user: profile or OST; many users: server or network | Connection Status; compare users (MAPI/HTTP guide) |
0x80040115 | MAPI_E_NETWORK_ERROR: a problem with network operations or services | DNS, firewall, proxy, load balancer or TLS between Outlook and the MAPI/HTTP endpoint | /mapi/healthcheck.htm on each server; Connection Status |
0x80040111 | MAPI_E_LOGON_FAILED: a client was unable to log on to the server | Wrong or expired credentials, disabled account, Kerberos or NTLM failure | 401s in IIS and HttpProxy logs (password prompt guide) |
0x80070005 | E_ACCESSDENIED / MAPI_E_NO_ACCESS: insufficient access rights | Missing Full Access or folder permission on a shared or delegated mailbox | Get-MailboxPermission; Get-MailboxFolderPermission |
0x80004005 | E_FAIL / MAPI_E_CALL_FAILED: failed for an unspecified reason | Generic; the real cause is usually reported alongside | A second code in the same task; Test E-mail AutoConfiguration |
0x8004010D | MAPI_E_NOT_ENOUGH_DISK: not enough disk space | The drive holding the OST or OAB files is full | Free space on the client's profile drive |
0x80040110 | MAPI_E_VERSION: client and server versions are not compatible | An old, unsupported Outlook build | Update Outlook and compare with Exchange's supported clients |
0x80040112 | MAPI_E_SESSION_LIMIT: unable to create any more sessions | Many mailboxes, apps or scripts opening sessions as one user | That user's entries in the HttpProxy logs; remove extra mailboxes and apps |
0x80040123 | ecTimeSkew (MAPI_E_INVALID_ACCESS_TIME): clock skew between servers | Client, domain controller and Exchange clocks differ | w32tm /query /status on each |
0x80040200 | MAPI_E_END_OF_SESSION: the server session was destroyed, possibly by a restart | Database failover, store process restart or application pool recycle | Application log and Get-MailboxDatabaseCopyStatus at that time |
0x8004011B | MAPI_E_CORRUPT_DATA: internal inconsistency in a database or complex property value | A corrupt item or folder in the mailbox, or a damaged OST | Rebuild the OST; New-MailboxRepairRequest |
0x80040700 | MAPI_E_AMBIGUOUS_RECIP: an unresolved recipient matches more than one directory entry | Two recipients share a display name or alias prefix | Get-Recipient -Anr "name" |
0x80040900 | MAPI_E_NAMED_PROP_QUOTA_EXCEEDED: the store can't hold more named property mappings | The mailbox has used up its named property quota, typically through applications creating many custom properties | Application log on the Mailbox server |
Connection messages in Outlook#
| Message | Meaning | Usual cause | First check |
|---|---|---|---|
The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action. | Outlook can't reach Exchange while creating a profile or opening data | Autodiscover answer, MAPI/HTTP URL or load balancer | Test E-mail AutoConfiguration (MAPI/HTTP guide) |
Microsoft Exchange is not available. Either there are network problems or the Exchange server is down for maintenance. | Outlook can't open a mailbox or folder on Exchange | Often public folders, archives or additional mailboxes with broken Autodiscover settings | Autodiscover results for that mailbox |
Cannot start Microsoft Outlook. Cannot open the Outlook window. The set of folders cannot be opened. | Outlook can't open its default store at start-up | Profile or OST damage, Autodiscover or account problems | The line under the message; a new test profile |
Autodiscover codes#
Outlook's Autodiscover log#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Autodiscover to https://autodiscover.contoso.com/autodiscover/autodiscover.xml Failed (0x800C8203) | That Autodiscover URL didn't return usable settings | Given by the GetLastError and httpStatus lines that follow | Autodiscover guide |
Autoconfiguration was unable to determine your settings! | Every Autodiscover method failed | SCP, DNS and certificate problems together | Work through the Log tab from the top |
GetLastError=12007 | ERROR_INTERNET_NAME_NOT_RESOLVED: the server name could not be resolved | Missing autodiscover record in internal or external DNS | Resolve-DnsName autodiscover.contoso.com |
GetLastError=12029 | ERROR_INTERNET_CANNOT_CONNECT: the attempt to connect to the server failed | The name resolves but nothing answers on 443: firewall, VIP down, wrong IP | Test-NetConnection autodiscover.contoso.com -Port 443 |
GetLastError=12002 | ERROR_INTERNET_TIMEOUT: the request has timed out | A firewall silently dropping traffic, a proxy, an overloaded server | The same test from the client's network; proxy settings |
GetLastError=12030 | ERROR_INTERNET_CONNECTION_ABORTED: the connection with the server has been terminated | A load balancer, firewall or TLS-inspection device closing the connection | Bypass the device for a test; its logs |
Certificate and TLS errors in the log#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
GetLastError=12038 | ERROR_INTERNET_SEC_CERT_CN_INVALID: the certificate's host name is incorrect | The certificate lacks the name Outlook connected to, often a server FQDN | Get-ExchangeCertificate | fl Thumbprint,CertificateDomains (name mismatch guide) |
GetLastError=12037 | ERROR_INTERNET_SEC_CERT_DATE_INVALID: the certificate is expired | Expired certificate on Exchange or the load balancer | Get-ExchangeCertificate | ft Thumbprint,NotAfter,Services (renewal guide) |
GetLastError=12045 | ERROR_INTERNET_INVALID_CA: unfamiliar certificate authority | Internal CA not trusted on that client, self-signed certificate, missing intermediate | The certificate path, viewed on the client |
GetLastError=12057 | ERROR_INTERNET_SEC_CERT_REV_FAILED: revocation of the certificate failed | The client can't reach the CA's CRL or OCSP address | certutil -verify -urlfetch on the exported certificate |
GetLastError=12044 | ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED: the server is requesting client authentication | Client certificates set to Accept or Require for the virtual directory in IIS | IIS Manager › Default Web Site › Autodiscover › SSL Settings |
GetLastError=12157 | ERROR_INTERNET_SECURITY_CHANNEL_ERROR: internal error loading the SSL libraries | Often no TLS version or cipher in common after hardening one side | TLS settings on client and server (TLS guide) |
HTTP responses and prompts#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
HTTP 401 on /Autodiscover, /mapi/emsmdb or /EWS | Unauthorized: credentials rejected | Wrong password, Kerberos without an ASA, Extended Protection behind SSL offloading | IIS and HttpProxy logs (password prompt guide) |
HTTP 404 | Not Found | The autodiscover name points at another web server, or the virtual directory is missing | Which IP answers; Get-AutodiscoverVirtualDirectory |
HTTP 500 | Internal Server Error | A failure inside Exchange or IIS: application pool or configuration | Application and HttpProxy logs (HTTP 500 guide) |
HTTP 503 | Service Unavailable | Application pool stopped, a protocol component Inactive, server drained | Get-ServerComponentState (inactive components) |
600 Invalid Request | Autodiscover answered, but the request wasn't a valid Autodiscover POST | Normal when you open autodiscover.xml in a browser; if Outlook gets it, something rewrote the request | A browser test: seeing 600 proves the service responds |
Allow this website to configure <address> server settings? | Outlook was redirected to another Autodiscover URL and asks before trusting it | Expected with redirect or SRV designs; otherwise a DNS record points somewhere unexpected | The redirect target on the Log tab; for an expected target, a RedirectServers registry value stops the prompt (Microsoft Learn) |
Certificate warnings#
| Message | Meaning | Usual cause | First check |
|---|---|---|---|
The name on the security certificate is invalid or does not match the name of the site | The URL's host name isn't on the certificate | Internal URLs using server names that aren't on the SAN certificate | Virtual directory URLs against the certificate names (guide) |
The security certificate has expired or is not yet valid. | The certificate is outside its validity dates | Expired certificate, or a wrong clock on the client | NotAfter in Get-ExchangeCertificate; the client's clock |
The security certificate was issued by a company you have not chosen to trust. | The issuing CA isn't trusted on this device | Self-signed or internal-CA certificate on a published URL | Use a certificate every client trusts |
POP3 and IMAP4 accounts#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x800CCC0E | Cannot connect to the server. | POP3/IMAP4 services stopped, wrong port or encryption setting, firewall | Get-Service MSExchangePOP3,MSExchangePOP3BE,MSExchangeIMAP4,MSExchangeIMAP4BE (POP3/IMAP4 guide) |
0x800CCC0F | The connection to the server was interrupted. | The session was dropped: TLS mismatch, idle timeout, connection limits, firewall | Protocol logging: Set-PopSettings / Set-ImapSettings -ProtocolLogEnabled $true |
How to verify a fix#
- Autodiscover: in Test E-mail AutoConfiguration (clear the two Guessmart boxes), the Log tab shows the expected URL succeeding with
0x00000000, and the Results tab lists your namespace URLs. - Connection: Connection Status shows every connection
Establishedover HTTP, with no repeated reconnects. - OAB: Send/Receive › Download Address Book completes, and the folder under
%LOCALAPPDATA%\Microsoft\Outlook\Offline Address Booksgets new files. - Server: the checks below come back clean for each server, then repeat the client tests from outside your network, for example with Microsoft Remote Connectivity Analyzer.
PowerShell
Test-MAPIConnectivity -Identity user@contoso.com
Get-ServerComponentState -Identity EX01 | Where-Object { $_.State -ne "Active" }
Get-OfflineAddressBook | Format-List Name,IsDefault,VirtualDirectories,GeneratingMailbox
Get-ExchangeCertificate | Format-Table Thumbprint,NotAfter,Services,Subject -AutoSize
curl.exe -s -o NUL -w "%{http_code}" https://autodiscover.contoso.com/autodiscover/healthcheck.htmGood: Success from Test-MAPIConnectivity, no inactive components, a default OAB with virtual directories, valid certificates and 200 from the health check. For Exchange Online mailboxes see Autodiscover for Exchange Online.
References#
- [MS-OXCDATA]: Error Codes (Microsoft Learn): names and meanings of the MAPI codes
- BITS Return Values (Microsoft Learn): the
0x8019xxxxOAB download codes - Error Messages (Wininet.h) (Microsoft Learn): the
GetLastErrorvalues - [MS-OXDSCLI]: ErrorCode (Microsoft Learn): Autodiscover error codes, including
600 Invalid Request
