How to fix Error 1933 on Windows 11

by

Troubleshooting Guide: Error 1933 – Delegated Trust Creation Quota Exceeded

Why This Error Happens

Error 1933 typically occurs in Active Directory environments when a computer or user account attempts to create more delegated trust objects (such as machine account joins or trust relationships) than allowed by the ms-DS-MachineAccountQuota attribute. This quota, which defaults to 10 in most AD configurations, limits how many computer accounts a single non-administrative user can create in the domain. Once this threshold is reached, Windows 11 blocks further domain-join or trust-creation attempts, even if the underlying permissions would otherwise allow it.

Step-by-Step Resolution Guide

Step 1: Verify the Current Machine Account Quota

  • Open Command Prompt or PowerShell with administrative privileges.
  • Run the following command to check the current quota value:
  dsquery * -filter (objectClass=domainDNS) -attr ms-DS-MachineAccountQuota
  • Confirm whether the returned value is set to 0 or a low number (e.g., 10), which indicates the quota has likely been exhausted.

Step 2: Increase or Reset the Quota via Active Directory

  • Open ADSI Edit (adsiedit.msc) on a domain controller.
  • Navigate to Domain [yourdomain.com], right-click the domain root, and select Properties.
  • Locate the ms-DS-MachineAccountQuota attribute and increase its value (e.g., from 10 to 50) or set it to 0 temporarily to disable the restriction for testing.
  • Click Apply and OK to save changes.

Step 3: Remove Stale or Unused Computer Objects

  • Open Active Directory Users and Computers (ADUC) on the domain controller.
  • Sort the Computers OU by “Last Logon” date to identify inactive or orphaned machine accounts.
  • Delete stale computer objects that are no longer in use, as these count against the creating user’s quota.
  • Re-attempt the domain join or trust creation operation on the Windows 11 client.

Step 4: Delegate Explicit Permissions Instead of Using Quota

  • In ADUC, right-click the target Organizational Unit (OU) and select Delegate Control.
  • Add the specific user or group account performing the join/trust operation.
  • Assign the permission “Create Computer Objects” explicitly, bypassing reliance on the default quota system entirely.

Alternative or Verification Steps

  • Re-run the domain join or trust creation command (e.g., Add-Computer in PowerShell) and confirm Error 1933 no longer appears in Event Viewer under Windows Logs > System.
  • If the issue persists, use Get-ADUser [username] -Properties msDS-MachineAccountQuota in PowerShell (RSAT tools required) to confirm the updated quota has replicated across all domain controllers.