How to fix Error 1932 on Windows 11

by

Troubleshooting Guide: Error 1932 – Delegated Trust Creation Quota Exceeded

Why This Error Happens

This error occurs when a computer account attempts to create more Active Directory trust objects than permitted by the ms-DS-MachineAccountQuota attribute, which by default limits domain-joined workstations to a specific number of computer object creations. This is commonly triggered on Windows 11 machines during domain rejoin operations, certain VPN/RRAS configurations, or when Active Directory Federation Services (AD FS) attempts to establish delegated trusts beyond the quota assigned to the requesting user account. The underlying cause is almost always a permissions or quota restriction set at the domain level, rather than a local file corruption issue.

Step-by-Step Resolution Guide

Step 1: Check the Current Machine Account Quota

  • Open Command Prompt as Administrator and run: dsquery * domainroot -attr ms-DS-MachineAccountQuota
  • Confirm whether the value is set to 0, which explicitly blocks all new object/trust creation for standard users.
  • Note the current domain controller you are querying against, as replication delays can cause inconsistent quota values.

Step 2: Increase or Reset the Quota via Active Directory

  • Open Active Directory Users and Computers (ADUC) or use ADSI Edit on a Domain Controller.
  • Navigate to the Domain root object, right-click, select Properties, and locate the ms-DS-MachineAccountQuota attribute.
  • Set the value higher (e.g., 10) using this PowerShell command on the DC: Set-ADDomain -Identity "yourdomain.com" -Replace @{"ms-DS-MachineAccountQuota"="10"}

Step 3: Grant Explicit “Create Computer Objects” Permission

  • If quota adjustments are restricted by policy, delegate specific permissions instead of relying on the global quota.
  • In ADUC, right-click the target Organizational Unit (OU) and select Delegate Control.
  • Assign the affected user or service account the Create Computer Objects permission directly on that OU.

Step 4: Clear Local Cached Credentials on the Windows 11 Client

  • On the affected Windows 11 machine, open Settings > Accounts > Access work or school.
  • Remove the connection, restart the machine, and re-establish the connection to force a fresh token request that respects the updated quota.
  • Alternatively, run klist purge in Command Prompt to clear stale Kerberos tickets that may be enforcing the old quota limit.

Alternative or Verification Steps

  • Verify the Fix: Attempt the trust creation action again (e.g., rejoining the domain or establishing the AD FS trust) and check the Event Viewer under Applications and Services Logs > Directory Service to confirm Error 1932 no longer appears.
  • Alternative Fix: If domain-level quota changes are not permitted due to security policy, have a Domain Admin manually pre-stage the computer object in AD before the join attempt, bypassing the need for the quota entirely.