Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Rob Ingenthron — Mon, 05 Nov 2012 22:08:37 GMT

Note sure if my long, detailed post was lost. To summarize, I think the info posted regarding MaxPageSize is incorrect. Reference:

3.1.1.3.4.6 LDAP Policies

msdn.microsoft.com/.../cc223376(prot.20).aspx

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Syeda A — Sun, 13 May 2012 21:44:21 GMT

Excellent stuff - way to go!

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Mike — Tue, 04 Oct 2011 19:30:35 GMT

good blog on how to defeat these limits, many thanks

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Jacob — Tue, 01 Feb 2011 06:40:45 GMT

excellent, i was struggling with this and reading the comments plus your value, its working now. thanq again

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Qasim Zaidi — Sat, 04 Dec 2010 09:40:59 GMT

Hi benguesmia, per msdn.microsoft.com/.../ms675656(VS.85).aspx

DS-Heuristics is a Unicode string in which each character contains a value for a single domain-wide setting. The DS-Heuristics string takes the following format.

| <1> | <2> | <3> | <4> | <5> | <6> | <7> | <8> | <9> | <10> | <11> | <12> | <13> |

To provide data validation, each tenth character is set to the character number divided by ten. For example, the tenth character is '1'; the twentieth character is '2', and so on.

HTH

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

benguesmia — Tue, 30 Nov 2010 11:11:01 GMT

Yesssss, it worked

we were blocked with our wifi router that authenticate users on Activedirectory (Fortigate)

and the authentication module was unable to retrieve more than 5000 users in a group

in spite of the fact that we had modified the ntds-settings.

but in the microsoft article : msdn.microsoft.com/.../cc223560(PROT.13).aspx

the bits start from 0 so th tenth bit is in fact the illeventh !

the bits you indicated starts from 1 so the tenth bit is the tenth :

are they wrong ?

i filled dsHeuristics with your version and it worked..

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Mamdouh Sadiq — Wed, 29 Sep 2010 18:11:50 GMT

wooow, cool blog Qasim.

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Bob Hoag — Thu, 09 Sep 2010 14:51:27 GMT

good one indeed, we often don't see a blog like this from Microsoft. But I reckon, with workaround like this, why would companies force their coders to re-write their code or work according to the RFC query standard. Regardless, I am happy to see that there is a way, in the interim, atleast.

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Shauna Webbers — Wed, 08 Sep 2010 14:21:51 GMT

Excellent Blog, thank you for sharing. I am sure we need to test our applications and OS requirements before migrating to Windows R2, this blog can help us buy more time.

re: Override the hardcoded LDAP Query limits introduced in Windows Server 2008 and Windows Server 2008 R2

Tim — Sun, 05 Sep 2010 12:31:53 GMT

wow, i did not think it was possible, yet, we were struggling to allow more than 5000 returns by a domain controller, you are absoultely right that it will take a lot of customers a long time to get to paged queries. In the meantime, its good to know there is a workaround we can use to breath. Thanks