| Previous | Next |
| ERROR_PER_USER_TRUST_QUOTA_EXCEEDED | ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED |
ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED
The total delegated trust creation quota has been exceeded.
ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED is Win32 error 1933 (0x78D). Unlike a per-user limit, this status says the combined delegated trust creation capacity for the administrative scope has been consumed. Retrying under another ordinary delegated account is therefore not a meaningful recovery.
Typical causes of aggregate exhaustion
- many delegated users or automation identities create trusts without a common inventory and retirement process
- temporary migration, acquisition, test, or tenant relationships accumulate beyond their intended lifetime
- duplicate creation attempts target alternate names for relationships that already exist
- cleanup is blocked by permissions, replication problems, or the separate delegated deletion quota
- the operation is being performed in the wrong domain or forest because discovery selected an unintended controller
What administrators should collect
Capture the forest/domain scope, requesting SID, partner names, requested trust attributes, selected domain controller, counts and owners of existing trust relationships, replication health, and recent creation/deletion events. Keep secrets out of diagnostics. Attribute every trust to a business owner and management workflow before deciding which objects are obsolete.
How to confirm the real constraint
Verify status 1933 on an authoritative controller and compare results across controllers after checking replication. Inventory delegated trusts, including partially created or disabled relationships, and identify duplicates or expired temporary entries. Determine whether deletion failures are preventing capacity from returning.
Do not assume a larger quota is the first remedy. Review why the aggregate number grew, whether all partners are still valid, and whether trust type and direction can be simplified. Investigate bursts as possible automation defects or unauthorized administration.
Recovery and capacity management
Retire confirmed obsolete relationships through supported trust-management procedures, repair replication or cleanup permissions, and then retry creation. If sustained legitimate demand exceeds policy, change the governance and limit through an approved security review rather than an emergency bypass.
Use a central inventory with owner, purpose, direction, creation time, and expiry. Make creation idempotent and alert before the aggregate limit is reached so business-critical onboarding is not blocked unexpectedly.
Difference from one user exhausting quota
ERROR_PER_USER_TRUST_QUOTA_EXCEEDED follows a particular delegated principal. Error 1933 describes the shared total, so changing to another delegated identity without cleanup normally preserves the failure.
Example
Several migration teams create temporary trusts independently. Even a newly delegated operator receives 1933 because the shared allowance is full. A reviewed inventory finds expired migration relationships; removing those and adding lifecycle ownership restores capacity.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: Win32 Error Codes in MS-ERREF
- Microsoft: Troubleshoot domain trust relationships
Looking for a different code? Search another status or error code.