| Previous | Next |
| ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED | ERROR_AUTHENTICATION_FIREWALL_FAILED |
ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED
The delegated trust deletion quota for this user is exhausted.
ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED is Win32 error 1934 (0x78E). The code applies to delegated removal of trust relationships by the current user. It is not evidence that the trust object is corrupt or that the partner domain is unreachable; the requested administrative change was stopped by a per-user deletion limit.
Why deletion activity reaches the limit
- bulk cleanup or migration rollback removes many relationships under one delegated account
- automation repeatedly attempts deletion without recognizing that a relationship is already absent or partially removed
- several products share the same delegated credential for trust lifecycle operations
- a compromised or misconfigured account generates an unusual deletion burst and the quota contains it
- operations target the wrong administrative scope because domain selection or credentials are incorrect
Deletion audit data
Record the requesting SID, trust partner, direction/type, local domain, selected controller, workflow ID, prior inventory state, and whether the opposite side was also changed. Never log trust passwords. Preserve directory and security audit events because a quota failure during deletion may leave an asymmetric relationship requiring careful reconciliation.
Diagnostic process
Confirm the current identity and count recent deletion attempts attributable to it. Determine which removals were legitimate, which were retries, and which may have completed on one side. Check replication before concluding that an object still exists everywhere.
Treat an unexpected burst as a security event. Review the automation change set and operator authorization before using a higher-privilege account. The quota may have prevented a wider destructive action.
Safe recovery
Pause automated cleanup, reconcile both sides of each affected trust, and continue approved deletions through a controlled account or after quota recovery according to policy. Do not distribute deletion across many accounts solely to evade the guardrail.
Make deletion idempotent and two-sided state explicit. Require ownership and approval for bulk operations, rate-limit destructive changes, and alert when a delegated principal approaches the threshold.
Difference from trust creation quotas
Errors 1932 and 1933 limit delegated creation. Error 1934 is specifically about deletion by the current user and deserves additional attention because an unexpected high deletion rate can be destructive or malicious.
Example
A decommissioning script loops over stale cached inventory and repeatedly submits the same trust removals. It eventually receives 1934. Stopping the job, refreshing directory state, and resuming only unresolved approved removals prevents further quota consumption.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: Win32 Error Codes in MS-ERREF
- Microsoft: Troubleshoot domain trust relationships
Looking for a different code? Search another status or error code.