When a phone stops syncing, the mail app shows a vague message, but Exchange records the real answer: a Status value in the ActiveSync response or an HTTP status in the IIS log. This quick reference lists the codes Exchange Server admins meet most, with the meaning from Microsoft's protocol documentation ([MS-ASCMD]), the usual on-premises cause and the first check.
Codes in this quick reference
112 ActiveDirectoryAccessDenied: the server can't read or write an object in the directory serviceActiveSync mailbox log (Status)123 UserHasNoMailbox: a mailbox could not be found for the userActiveSync mailbox log (Status)124 UserCannotBeAnonymous: the request was sent without credentialsActiveSync mailbox log (Status)125 UserPrincipalCouldNotBeFound: the user was not found in the directory serviceActiveSync mailbox log (Status)126 UserDisabledForSync: the user is not allowed to use ActiveSyncActiveSync mailbox log (Status)129 DeviceIsBlockedForThisUser: the user may sync only some devices and this isn't one of themActiveSync mailbox log (Status)130 AccessDenied: the user is not allowed to perform that requestActiveSync mailbox log (Status)131 AccountDisabled: the user's account is disabledActiveSync mailbox log (Status)
+ 48 more codes in the tables below.
How to read these codes#
- Status element: every command response carries a
Statusvalue;1means success. To see them for one user, turn on mailbox logging, reproduce the problem and collect the log, which shows each request and response. - IIS log:
/Microsoft-Server-ActiveSyncrequests in%SystemDrive%\inetpub\logs\LogFiles\W3SVC1show the command (Cmd=Sync,Cmd=Ping), the device ID and type, and the HTTP status.
PowerShell
Set-CASMailbox jane@contoso.com -ActiveSyncDebugLogging $true
# reproduce the problem on the phone, then send yourself the log:
Get-MobileDeviceStatistics -Mailbox jane@contoso.com -GetMailboxLog -NotificationEmailAddresses admin@contoso.com
Set-CASMailbox jane@contoso.com -ActiveSyncDebugLogging $false| Values | Family | How to read it |
|---|---|---|
101–184 | Common status codes | Same meaning for every command; sent to protocol 14.0 and later clients |
1–16 | Command-specific codes | The meaning depends on the command: Sync status 9 (mailbox may be out of space) isn't FolderSync status 9 (bad sync key) |
HTTP 4xx / 5xx | IIS log status | Protocol 2.5, 12.0 and 12.1 clients get these instead of 1xx values; any client gets one if the request fails before ActiveSync handles it |
Each value also has a scope: Global (the whole request failed), Item (one item failed, the rest went through) or Policy (the Provision command).
Account, device and access codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
112 ActiveDirectoryAccessDenied | The server can't read or write an object in the directory | Exchange can't create the device container under the user (inheritance off, often admin accounts) | Event ID 1053 in the Application log (ActiveSync guide) |
123 UserHasNoMailbox | No mailbox found for the user | No on-premises mailbox, for example after a move to Exchange Online | Get-Recipient jane | fl RecipientTypeDetails |
124 UserCannotBeAnonymous | The request arrived without credentials | A proxy drops the credentials, or virtual directory authentication changed | Get-ActiveSyncVirtualDirectory | fl Server,*Auth* |
125 UserPrincipalCouldNotBeFound | The user wasn't found in the directory | Wrong sign-in name (email address differs from the UPN) or a new account not replicated yet | Get-User with the exact name the phone uses |
126 UserDisabledForSync | The user isn't allowed to use ActiveSync | ActiveSync disabled on the mailbox | Get-CASMailbox jane | fl ActiveSyncEnabled |
129 DeviceIsBlockedForThisUser | The user may sync only certain devices, and this isn't one of them | The mailbox's device ID lists don't include this phone | Get-CASMailbox jane | fl ActiveSync*DeviceIDs |
130 AccessDenied | The user isn't allowed to perform that request | A permission or block decision for this user or device | Get-MobileDevice -Mailbox jane | fl DeviceId,DeviceAccessState* |
131 AccountDisabled | The user's account is disabled | Disabled AD account, or a shared or resource mailbox account used to sign in | Get-ADUser jane | Select-Object Enabled |
177 MaximumDevicesReached | Too many device partnerships; delete some first | Retired phones pile up until the throttling policy limit (EasMaxDevices) is hit | List and remove stale partnerships (below); policies: throttling guide |
PowerShell
Get-MobileDeviceStatistics -Mailbox jane@contoso.com |
Sort-Object LastSuccessSync | Format-Table Identity, DeviceType, LastSuccessSync -AutoSize
Remove-MobileDevice -Identity "<Identity of a retired phone>"Policy and provisioning codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
139 / 141 DeviceNotFullyProvisionable / LegacyDeviceOnStrictPolicy | The device can't apply every policy setting (139) or can't provision at all (141) | The policy demands settings the app can't enforce, and non-provisionable devices aren't allowed | Get-MobileDeviceMailboxPolicy | fl Name,IsDefault,AllowNonProvisionableDevices |
140 RemoteWipeRequested | A remote wipe is pending; the device should provision to receive it, then acknowledge it | Expected after a wipe request; repeats mean the device never confirms | Get-MobileDeviceStatistics -Mailbox jane | fl DeviceId,*Wipe* |
142 DeviceNotProvisioned | A policy applies and the device must provision first | Normal on a first sync; a loop means the device can't accept the policy (passcode, encryption) | Get-MobileDeviceStatistics -Mailbox jane | fl DeviceId,*Policy* |
143 / 144 PolicyRefresh / InvalidPolicyKey | Provision again: refresh interval passed (143) or the policy key is invalid, usually after a policy change (144) | Normal after a policy edit or reassignment; a loop points at the app | Get-CASMailbox jane | fl ActiveSyncMailboxPolicy |
145 ExternallyManagedDevicesNotAllowed | The device says another system manages it, but the server doesn't allow externally managed devices | The policy doesn't allow external device management | Get-MobileDeviceMailboxPolicy | fl Name,AllowExternalDeviceManagement |
Server, mailbox and sync state codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
110 ServerError | Unknown server error; the device shouldn't retry | A server-side exception for this mailbox or item | Application log at the failure time |
111 ServerErrorRetryLater | Unknown server error; the device should retry later | Transient: database failover, restart, busy server | Get-MailboxDatabaseCopyStatus; ActiveSync health sets |
113 MailboxQuotaExceeded | The mailbox reached its size quota | Mailbox over its quota | Get-MailboxStatistics jane | fl TotalItemSize (quota guide) |
114 MailboxServerOffline | The mailbox server is offline | Database dismounted, server down or in maintenance | Get-MailboxDatabaseCopyStatus; Get-ServerComponentState |
132 SyncStateNotFound | The device's sync state file is missing; the next request will likely force a full sync | State removed while a request ran, for example a deleted partnership | Let the device resync; if it recurs, the Application log |
133 SyncStateLocked | The sync state is locked, possibly by a current or recent mailbox move | A mailbox move in progress or just finished | Get-MoveRequest jane (move guide) |
134 / 136 SyncStateCorrupt / SyncStateVersionInvalid | The sync state looks corrupt (134) or has an invalid version (136) | Damaged partnership data | Remove the partnership, then add the account again on the phone |
148 RemoteServerHasNoSSL | The request must be proxied to a server without SSL, and this server only proxies to SSL servers | The target server's ActiveSync virtual directory doesn't require SSL | SSL settings of that virtual directory in IIS |
151 TooManyFolders | Too many folders; by default a mailbox can't have more than 1,000 | Large folder trees, often from imports | (Get-MailboxFolderStatistics jane).Count |
Sending mail and item codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
115 SendQuotaExceeded | The request would exceed the send quota | Mailbox above its send quota | Get-Mailbox jane | fl *Quota* |
116 MessageRecipientUnresolved | A recipient couldn't be resolved to an email address | A name or contact without a valid address | Send to the same recipient from OWA |
119 / 183 MessageHasNoRecipient / InvalidRecipients | No recipient (119), or a draft without recipients or with a non-SMTP address (183) | The app sent an incomplete message | Reproduce in OWA; update the app |
120 MailSubmissionFailed | The server failed to submit the message for delivery | Transport not accepting mail: back pressure, stopped services, stuck Submission queue | Get-Queue; Event ID 15004 (back pressure guide) |
122 AttachmentIsTooLarge | The attachment is too large for this request | ActiveSync request limits or message size limits | Message size limits |
118 MessagePreviouslySent | The message was already sent, or its client ID was used recently | The device retried a send that already went through | Nothing if occasional; check Sent Items |
150 ItemNotFound | The item being replied to or forwarded (SmartReply, SmartForward) wasn't found | The original was deleted or moved first | Whether the original still exists |
Calendar, availability and IRM codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
160 / 161 AvailabilityTooManyRecipients / AvailabilityDLLimitReached | Too many recipients for one free/busy lookup, or a distribution list too big for the availability service | Large meetings or groups | Fewer attendees or smaller groups |
162 / 163 AvailabilityTransientFailure / AvailabilityFailure | The availability (free/busy) request failed, temporarily (162) or not (163) | Availability service problems, often cross-premises | OWA Scheduling Assistant for the same people (free/busy guide) |
168 IRM_FeatureDisabled | Information Rights Management is disabled | IRM not enabled for ActiveSync clients | Get-IRMConfiguration | fl ClientAccessServerEnabled; policy IrmEnabled |
169 / 170 IRM_TransientError / IRM_PermanentError | IRM encountered an error (temporary or permanent) | RMS connectivity, licensing or templates | Test-IRMConfiguration (IRM guide) |
184 OneOrMoreExceptionsFailed | Not all exceptions of a recurring series were saved; the client resends the failed ones | Problems with specific occurrences | The exception statuses in the mailbox log |
Malformed request codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
101 / 102 / 103 InvalidContent / InvalidWBXML / InvalidXML | Invalid body, undecodable WBXML, or XML that breaks the protocol rules | An app bug, or a security device rewriting requests | Another app; bypass the inspecting device |
108 / 109 DeviceIdMissingOrInvalid / DeviceTypeMissingOrInvalid | The device ID or type is missing or badly formatted | A non-standard client or a rewriting proxy | The DeviceId and DeviceType values in the IIS log |
137 / 138 CommandNotSupported / VersionNotSupported | Command not supported, or not in the requested protocol version | The app asks for something the server doesn't offer | The client's protocol version in the mailbox log |
Sync, FolderSync and Ping status codes#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Sync 3 | Invalid synchronization key, or corrupted sync state; the folder restarts from key 0 | Device and server disagree about the sync state | Occasional: harmless; constant: re-create the partnership |
Sync 5 | Server error, frequently transient | Misconfiguration, a temporary issue or a bad item | Retry; one folder always failing: a damaged item |
Sync 8 | Object not found: the folder or item ID is no longer valid | Deleted on the server or by another client | Resync the folder |
Sync 9 | The Sync command can't be completed; the account could be out of space | Mailbox over quota | Mailbox size and quotas |
Sync 12 | The folder hierarchy changed; folders aren't synchronized | Folders created, renamed or deleted elsewhere | Device runs FolderSync; a loop suggests a damaged folder |
Sync 14 | The Wait or HeartbeatInterval value is outside the administrator's range; the response gives the limit | Client heartbeat outside server limits | Normally self-correcting; check idle timeouts on firewalls and load balancers |
Sync 16 | Retry: a retriable server error | A temporary server-side condition | If it recurs, the Application log |
FolderSync 9 | Synchronization key mismatch or invalid key, or corrupt sync state on the server | Folder list state out of step | The device resyncs from key 0; repeating: re-create the partnership |
FolderSync 6 / 11 | An error occurred on the server / an unknown error occurred; frequently transient | A server issue or a bad item | Retry; persistent: Application log and mailbox log |
Ping 7 | Folder hierarchy sync required | Folders changed since the last FolderSync | Normal once; the device should run FolderSync |
Ping status 1 (heartbeat expired, nothing changed) and 2 (changes in a monitored folder) are normal, not errors.
HTTP status codes in the IIS log#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
400 | Bad request; older protocol versions get it instead of 101, 103, 106 or 138 | A malformed request from the app | User agent in the IIS log; update the app |
401 | Credentials rejected | Wrong password or sign-in name, or authentication changed on the virtual directory | Get-ActiveSyncVirtualDirectory | fl *Auth* (ActiveSync guide) |
403 | Forbidden; older versions get it instead of 112, 125 or 126 | User not enabled for ActiveSync, not found, or directory access denied | ActiveSyncEnabled; Event ID 1053 |
449 | The device must provision first; older versions get it instead of 141 to 144 | The device hasn't applied the mailbox policy | AllowNonProvisionableDevices; the device's policy status |
451 | Redirect: the mailbox is served elsewhere | Common after a move to Exchange Online | Re-add the account if the phone doesn't follow (Exchange Online mobile access) |
500 | Server error; older versions get it instead of 110 or 132 | A server-side exception; Event ID 1053 is the classic | Application log at the same time |
503 | Service unavailable; older versions get it instead of 111 | Stopped app pool, ActiveSyncProxy inactive, busy server, no healthy back end | Get-ServerComponentState; /Microsoft-Server-ActiveSync/healthcheck.htm |
507 | Older versions get it instead of 113 (mailbox quota exceeded) | Mailbox over quota | Mailbox size and quotas |
How to verify a fix#
- Device:
Get-MobileDeviceshows the deviceAllowed, andLastSuccessSyncmoves forward with each sync. - IIS log: the device's
Cmd=Sync,Cmd=FolderSyncandCmd=Pingrequests return200. - Mailbox log: Sync and FolderSync return status
1; Ping returns1or2. Then turn logging off.
PowerShell
Get-MobileDeviceStatistics -Mailbox jane@contoso.com |
Format-List DeviceId, DeviceType, LastSuccessSync, LastSyncAttemptTime
Get-MobileDevice -Mailbox jane@contoso.com | Format-List DeviceId, DeviceAccessState, DeviceAccessStateReason
Get-HealthReport EX01 | Where-Object { $_.HealthSet -like "ActiveSync*" }
Set-CASMailbox jane@contoso.com -ActiveSyncDebugLogging $falseGood: a recent LastSuccessSync, DeviceAccessState : Allowed and healthy ActiveSync health sets. For quarantine and access rules, see ActiveSync not syncing on Exchange Server.
References#
- [MS-ASCMD]: Common Status Codes (Microsoft Learn): the 101–184 values and the HTTP codes older protocol versions get instead
- [MS-ASCMD]: Status (Sync) (Microsoft Learn)
- [MS-ASCMD]: Status (FolderSync) and Status (Ping) (Microsoft Learn)
- Troubleshoot ActiveSync with Exchange Server (Microsoft Learn)
