Overview#

QueryPolicy objects can be created in the Query Policies container, which is a child of the Directory Service container in the Configuration Directory Partition naming context.

Active Directory LDAP Defaults[1] #

Therefore the effective setting for the above LDAP policy is MaxPageSize=50000 and MaxValRange=25000 on a Windows Server 2003 Domain Controller as configured in the LDAP policy in Active Directory but on a Windows Server 2008 R2 or Windows Server 2008 Domain Controller the hardcoded limits dictate MaxPageSize=20000 and MaxValRange=5000.

MaxValRange affects the number of attributes returned for a query. If you perform a SearchRequest for the multi-valued attribute Member for a group object with more than 5000 members the Windows Server 2008 R2 or Windows Server 2008 domain controller will only return 5000 of them.

The use of the Simple Paged Results Control maybe used to retrieve all the results.

Where are LDAP policy in Active Directory values set#

There can be multiple queryPolicy objects in a AD Forest. A DC determines the queryPolicy object that contains its policies according to the following logic:

• If the queryPolicyObject attribute is present on the DC's nTDSDSA object, the DC uses the queryPolicy object referenced by it.
• Otherwise, if the queryPolicyObject attribute is present on the nTDSSiteSettings object for the Active Directory Site to which the DC belongs, the DC uses the queryPolicy object referenced by the Active Directory Site.
• Otherwise, the DC uses the queryPolicy object whose DN is "CN=Default Query Policy,CN=Query-Policies" relative to the nTDSService object (for example, "CN=Default Query Policy, CN=Query-Policies, CN=Directory Service, CN=Windows NT, CN=Services" relative to the root of the config NC).

Reboot requirement#

LDAP administration limits#

• InitRecvTimeout
• MaxActiveQueries
• MaxConnections
• MaxConnIdleTime
• MaxDatagramRecv
• MaxNotificationPerConnection
• MaxPageSize
• MaxPoolThreads
• MaxResultSetSize
• MaxQueryDuration
• MaxTempTableSize
• MaxValRange
• MaxResultSetsPerConn - (Default: 10) - The maximum number of individual Simple Paged Results Control SearchRequest per LDAP connection for which a Domain Controller will store optimization data. The data that is stored is outside the state model and is implementation-specific.
• MinResultSets- (Default: 3) - The minimum number of individual paged searches for which a Domain Controller will store optimization data. The data that is stored is outside the state model and is implementation-specific.
• MaxBatchReturnMessages - (Default: 1100) - The maximum number of messages that can be returned when processing an LDAP_SERVER_BATCH_REQUEST_OID extended operation.
• MaxPercentDirSyncRequests - (Default: 100) - The maximum percentage of LDAP threads that can be performing a search using the LDAP_SERVER_DIRSYNC_OID or LDAP_SERVER_DIRSYNC_EX_OID at one time.
• MaxValRangeTransitive - This policy has no significance.
• ThreadMemoryLimit - This policy affects implementation-specific memory allocation and limits.
• SystemMemoryLimitPercent - This policy affects implementation-specific memory allocation and limits.
• MaxDirSyncDuration - (Default: 60) - The maximum time, in seconds, that a DC will spend on a single SearchRequest when using the LDAP_SERVER_DIRSYNC_OID or LDAP_SERVER_DIRSYNC_EX_OID controls. When this limit is reached, the DC returns a LDAP_TIMELIMIT_EXCEEDED / LDAP_PARAM_ERROR error.

How To Change Values#

LDIF for LDAP policy in Microsoft Active Directory#

This is an export of the policy for a server. The "DC=mad,DC=example,DC=com" is AD DOMAIN and Windows Server Version dependent.

dn: CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=mad,DC=example,DC=com
objectClass: top
objectClass: queryPolicy
cn: Default Query Policy
distinguishedName: CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=mad,DC=example,DC=com
instanceType: 4
lDAPAdminLimits: MaxValRange=1500
lDAPAdminLimits: MaxReceiveBuffer=10485760
lDAPAdminLimits: MaxDatagramRecv=4096
lDAPAdminLimits: MaxPoolThreads=4
lDAPAdminLimits: MaxResultSetSize=262144
lDAPAdminLimits: MaxTempTableSize=10000
lDAPAdminLimits: MaxQueryDuration=120
lDAPAdminLimits: MaxPageSize=1000
lDAPAdminLimits: MaxNotificationPerConn=5
lDAPAdminLimits: MaxActiveQueries=20
lDAPAdminLimits: MaxConnIdleTime=900
lDAPAdminLimits: InitRecvTimeout=120
lDAPAdminLimits: MaxConnections=5000
name: Default Query Policy
objectCategory: CN=Query-Policy,CN=Schema,CN=Configuration,DC=mad,DC=example,DC=com
objectGUID:: 77+9V2dTeO+/vQtO77+9F......9fO+/vQ==
showInAdvancedViewOnly: TRUE
uSNChanged: 4124
uSNCreated: 4124
whenChanged: 20081213153904.0Z
whenCreated: 20081213153904.0Z