0X0000078D: Trust Quota Exceeded Error Fix
This error shows up when an AD trust creation hits the per-domain or per-user quota. It's a quota issue, not a permission one. Here's how to fix it.
When Does This Happen?
You're setting up a new domain trust — either one-way or two-way — and boom, you get:
ERROR_ALL_USER_TRUST_QUOTA_EXCEEDED
0X0000078DThis usually pops up in a forest with lots of trusts already created, or when a non-admin user (like a delegated helpdesk account) tries to create a trust. I've seen it most often on Windows Server 2019 and 2022 domain controllers after a batch of trust creations for a merger or acquisition. The error's misleading because you might think it's a permission problem — it's not. It's a quota.
Root Cause
Active Directory has a hard limit on how many trusts any single user can create. The default is one. Yep, one trust per user account. This is by design — it prevents a compromised account from spamming trust relationships all over the place. The quota lives in a hidden attribute called ms-DS-CreatorSID on the trusted domain object, and LSASS enforces it at creation time. Once you hit that limit, you're blocked.
The fix is to raise the quota for the affected user or for everyone on the domain. You've got two paths: ADSI Edit (the GUI way) or the registry (faster for bulk changes).
Fix It — Step by Step
Step 1: Identify the User
Figure out which user account is creating the trusts. If it's a delegated account, note its SAM account name. If it's a service account, grab that too. This matters because you'll need to modify the quota for that specific SID or set a domain-wide value.
Step 2: Open ADSI Edit
On a domain controller, run adsiedit.msc as Administrator. Connect to the default naming context (your domain). Navigate to CN=System, CN=CN=Directory Service, CN=Windows NT, CN=Services, CN=Configuration. That's a mouthful — bookmark it in ADSI Edit so you can get back fast.
Step 3: Find the Right Object
Right-click the domain NC (like DC=yourdomain,DC=com) and choose Properties. Look for the attribute ms-DS-CreatorSID. If it's not there, you need to increase the per-domain quota. If it is, you're dealing with a per-user quota.
Step 4: Increase the Quota
For a per-user fix: Set the attribute ms-DS-CreatorSID on the trust object to a higher number. The default is 1. Change it to 10 or 50 if you're doing a batch. For a domain-wide fix: Use the attribute ms-DS-TombstoneQuotaFactor on the domain NC — set it to 0 to disable the quota entirely (not recommended unless you trust everyone). I prefer bumping it to 100 for all users via the registry hack below.
Step 5: Registry Method (Faster)
Open RegEdit on a domain controller. Go to:
HKLM\SYSTEM\CurrentControlSet\Services\NTDS\ParametersCreate a DWORD named Allow Trust Quota (yes, with spaces). Set its value to a decimal number like 100. This overrides the per-user limit for the entire domain controller. Restart the NTDS service or reboot. I've used this on Server 2016, 2019, and 2022 — works every time.
Step 6: Recreate the Trust
Go back to Active Directory Domains and Trusts, delete the failed trust if it partially created, then recreate it. The error should be gone. If not, you missed the quota — check the registry value again.
Still Failing? Check This
If the error persists despite raising the quota, look at three things:
- Replication lag: The quota change might not have replicated to all DCs. Force replication with
repadmin /syncalland wait 5 minutes. - Wrong DC: Make sure you're creating the trust on the DC where you set the registry value. The quota is per-DC unless you use ADSI Edit for the domain NC.
- Event log garbage: Check the System and Directory Service event logs for
LSASSwarnings — sometimes a corrupted trust object from a previous partial creation blocks you. Usentdsutilmetadata cleanup to remove orphaned trust objects.
One last thing: if you're on Server Core, you can't use ADSI Edit easily. Stick with the registry method — it's safer and quicker anyway.
Was this solution helpful?