Folder limit error in ADSIedit

[Michael]

Hi, I am using ADSIedit occasionally to view / modify
properties of user accounts.

If I attempt this on any DC, except one, I get the
following error message:
-------------------------------------------------------
There are too many items in the folder OU=XXXXXXXX Please
refine the query parameters or increase the maximum number
of items per folder.
-------------------------------------------------------

The folders this occurs on have about 30,000 users in them.
It would appear that the maximum is 10,000, on all but the
one DC. I have no idea what was done by previous
administrators to increase this limit on this one DC.

I am in the process of rebuilding all of the DC's in the
domain, and do not want to lose this capability.

Thanx,
Michael

 

[Simon Geary]

10,000 hits is a built in limit for performance reasons. You can change it
by following this kb.
http://support.microsoft.com/?id=243281

 

[Michael]

Tried this one. It increases the limits on most system
wide things like the add user to group dialog box, but
does not affect the behavior in ADSIedit.

Any other ideas ?

 

[Simon Geary]

I found this article from Mark Minasi and he doesn't know how to increase
the limit for ADSI Edit. Maybe it can't be done, I'm afraid I don't know.
http://www.winnetmag.com/ActiveDirectory/Article/ArticleID/42605/ActiveDirectory_42605.html

 

[Guest]

Thanx for trying. I had seen the article also, but am not
a subscriber, so was not able to read the whole article.

I know this can be done, because one of my DC's does not
have the 10,000 item limit, so one of the prior admins
must hve known how to change this.

Thanx again.
Michael

 

[Simon Geary]

I asked your question in the private MVP groups and this answer came back
from Matt Rimer from Microsoft, might be useful for you.

"That setting you refer to looks like a client-side policy. I don't believe
ADSIEdit picks up that policy setting. It looks like in ADSIEdit what you
do is, from the context menu on the Domain node, select View --> Filter and
adjust the "Max number of items per container" setting (which defaults to
10000). It also looks like ADSIEdit will also save those settings, so that
may be why you're getting different results on different machines.

It's not clear if he's running ADSIEdit on one machine and targeting three
different DCs, or if he's actually running it on the three different DCs.
If the former, then the same client-side setting will be applied regardless
of DC, so the setting I mentioned above wouldn't explain the different
results for different DCs. If that's the case, it sounds like he's running
into some server-side policy limit on the DC. The only server-side policy I
know of that defaults to 10000 records is max temp table size. You might
want to have him check that policy setting on the 3 DCs (ntdsutil.exe can be
used to do this). Note, this should _not_ necessarily be construed as a
recommendation to increase the max temp table size on that DC (increasing
such server policies should be done only after careful consideration, since
they can increase the load placed on the DC and make a denial-of-service
attack easier) --- I'm just recommending comparing the policies as a
debugging step."

 

[Michael]

That did the trick!

"...from the context menu on the Domain node, select View -
-> Filter and adjust the "Max number of items per
container" setting..."

Thank you very much!
I knew it had to be something simple like that, but could
not find it.

As to Matt's question, sorry I was so unspecific.
I have the Support Tools installed on all DC's, and I was
running ADSIedit on each of them and comparing the
behavior. (As opposed to running on one, against all
three...).

Thank you ever so much again.
Now I will not have to worry about losing this capability
when I rebuild / replace the one DC that would read over
10,000.

Michael

 

[impeeza]

Hi, the problem described is about the MMC console display folder's content. in the past mmc has the filter item in the view menu. now these item is gone, if you need it you have to go the root of left tree (generally "Default Naming Context....") and select it. then in the view menu is now the item filter, if you select it a new dialog is opened and you can select the limit for all folders in tree. the default is 10000.

¡CAUTION! display lot of items in a folder can take long long time.