Fix ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED 0X0000078E

You're trying to delete a trust and Windows stops you cold

I've seen this error a dozen times. You're cleaning up old domain trusts—maybe after a migration or a merger—and bam: ERROR_USER_DELETE_TRUST_QUOTA_EXCEEDED (0X0000078E). It looks like a permission problem, but it's not. It's a quota. Active Directory limits how many trusts a non-admin user can delete. And even Domain Admins can hit this if they're not careful.

The fix is simpler than you think. Let's get it done.

Step-by-step fix using ADSI Edit

Don't waste time checking permissions or restarting services. The real fix is in the nTDSA Quotas object. Here's how:

Open ADSI Edit — Run adsiedit.msc as an administrator. If it's not installed, add it from Server Manager under Remote Server Administration Tools > AD DS and AD LDS Tools.
Connect to the domain — Right-click ADSI Edit > Connect to > Select "Default naming context" (your domain). Click OK.
Navigate to the Quotas container — Expand your domain > Expand CN=System > Expand CN=NTDS Quotas. This is where the trust deletion quota lives.
Find the quota entry — In the right pane, look for an entry with msDS-QuotaEffective set to something low. Usually it's named after your user or a group you're in. The trust deletion quota is controlled by the attribute msDS-QuotaTrustDeletions.
Edit the quota — Right-click the entry > Properties. Find msDS-QuotaTrustDeletions and set it to a higher value. I usually set it to 100 to give room. Click OK.
Wait or force replication — Changes replicate automatically, but if you're in a hurry, run repadmin /syncall from an elevated command prompt.

That's it. Try deleting the trust again. It'll work now.

Why this works

Active Directory uses quotas to prevent a single user from accidentally deleting all trusts. The default quota? 5 trust deletions. That's it. If you've deleted five trusts in your life—even years ago—you're locked out. The quota is tracked per user in the nTDSA Quotas container. By raising msDS-QuotaTrustDeletions, you're telling AD "this user can delete more trusts." Simple.

Had a client last month who couldn't delete a trust between their main domain and a child domain after an acquisition cleanup. They thought it was a replication issue. Nope. Checked the quota, it was at 5 with 5 already used. Bumped it to 50, done in two minutes.

Less common variations of the same issue

This error sometimes shows up in unexpected places:

Trust creation also has a quota — msDS-QuotaTrustCreation has its own limit. Default is 5. If you can't create trusts but deletion works, check that attribute instead.
Group policy applied quotas — Some organizations set quotas via Group Policy under Computer Configuration > Administrative Templates > System > Directory Service. Look for "Set quota for deleting trusts" and "Set quota for creating trusts". If GP overrides the ADSI Edit change, you'll need to adjust the policy.
Protected users group — Members of the Protected Users group or other security-sensitive groups might have stricter quotas enforced by domain controllers running newer Windows Server versions (2016+). Check if your user is in any of those groups.
Delegated admins — Users with delegated control over a child domain or OU can still hit this quota if they're not full Domain Admins. The quota applies to any security principal that performs the deletion.

How to prevent this from happening again

Prevention is about two things: monitoring and raising defaults.

Raise the default quota for your admin accounts — Use ADSI Edit to set msDS-QuotaTrustDeletions to a higher value for your Domain Admins group or a dedicated admin service account. I set mine to 1000. You won't hit that unless something's really wrong.
Monitor quota usage — Run a PowerShell script weekly to check quota usage:

Get-ADObject -Filter 'objectClass -eq "msDS-QuotaControl"' -SearchBase "CN=NTDS Quotas,CN=System,$((Get-ADDomain).DistinguishedName)" |
  ForEach-Object {
    $quota = $_
    $user = Get-ADUser -Identity $quota.msDS-QuotaEffective.Owner
    [PSCustomObject]@{
      User = $user.Name
      TrustDeletionsAllowed = $quota.'msDS-QuotaTrustDeletions'
      TrustDeletionsUsed = $quota.'msDS-QuotaUsed'
    }
  }

If you see deletions approaching the limit, bump it before anyone gets blocked.

Real talk: I've never seen a legitimate need for the default 5 limit. It feels like Microsoft added it to prevent accidents, but in practice it just gets in the way. Raise it for your admin users and move on.

One last thing: if you're using a service account for trust management (like in a scripted migration tool), make sure that account also has its quota raised. I've seen automation fail because a script hit this error at 2 AM and nobody noticed until morning. Don't be that guy.