STATUS_PER_USER_TRUST_QUOTA_EXCEEDED (0XC0000401) Quick Fix

Yeah, this error's a pain — you're trying to create a trust between domains and AD just slams the door with 0XC0000401. Don't waste time restarting services or reimaging. The culprit here is almost always the per-user trust quota in Active Directory. By default, each user can create up to 5 delegated trusts. Once you hit that, you get this error.

Fix It in 2 Minutes

Open a command prompt as admin — not PowerShell yet, just cmd. Run:

ntdsutil
set behavior
connections
connect to server <your_domain_controller>
quit
show quotas

Look for the Delegated - Trusts quota. If you're at 5 and you need more, run:

set quota <your_username> DN="CN=<user_dn>,OU=<ou>,DC=<domain>,DC=<com>" Delegate-Trusts 10

Replace the DN with your full distinguished name. You can find it with dsquery user -name <username>. Set the number to whatever you need — I usually bump it to 10 or 15. Then quit out and restart the Active Directory Domain Services service on the DC you're targeting:

net stop ntds && net start ntds

Try creating the trust again. Should work now.

Why That Worked

Active Directory has a built-in safety valve — the Delegated - Trusts quota. It's controlled via ms-DS-Quota-Object in the directory. Each user gets 5 by default. When you exceed it, the system returns STATUS_PER_USER_TRUST_QUOTA_EXCEEDED. Raising the quota bypasses that limit. No magic, just a config change.

Less Common Variations

Sometimes the quota looks fine but the error still appears. Here's what I've seen:

• Group Policy restriction — A Deny ACE on the Delegated - Trusts permission can block even if quota is high. Check dsacls on the domain object.
• Corrupted trust objects — Orphaned trusts from failed creation count against the quota. Run netdom trust <domain> /remove on any dead trusts.
• Different DC holding the quota — The quota is per-DC for the PDC emulator role. If you're hitting a non-PDC, the error can be stale. Force replication with repadmin /syncall.
• User context issue — If you're running the trust wizard as a service account or a member of a group that's been delegated different quotas, the numbers may not match. Verify with ntdsutil show quotas for the specific user.

Prevention

Don't wait for this to bite you again. Do a few things now:

1. Assign quotas to groups, not individuals — Create an AD group for trust admins, then set their quota to 20. This avoids hunting down user DNs later.
2. Clean up old trusts quarterly — Use Get-ADTrust -Filter * in PowerShell to list all trusts. Remove anything stale with Remove-ADTrust.
3. Monitor quota usage — Run repadmin /showattr * "CN=<domain>,CN=Partitions,CN=Configuration,DC=<forest>," /filter:"(objectClass=trustedDomain)" to see how many trusts exist per user.
4. Log the quota — Audit changes to the ms-DS-Quota-Effective attribute. It'll tell you who's hitting the ceiling.

One last thing — if you're in a big forest with hundreds of trusts, consider using a dedicated service account with unlimited quota (set quota "DOMAIN\svc_trustadmin" DN="..." Delegate-Trusts -1). Negative means no limit. Just be careful — that account can create as many trusts as it wants.