Active Directory Cookbook

4.7. Searching for a Large Number of Objects

Problem

Your search is returning only 1,000 objects and you want it to return all matching objects.

Solution

You might notice that searches with large numbers of matches stop displaying after 1000. Domain controllers return only a maximum of 1,000 entries from a search unless paging is enabled. This is done to prevent queries from consuming a lot of resources on domain controllers by retrieving the results all at once instead of in “pages” or batches. The following examples are variations of Recipe 4.5, which will show how to enable paging and return all matching entries.

Using a graphical user interface

1. Perform the same steps as in Recipe 4.5, but before clicking OK to start the search, click the Options button.

2. For Timeout (s), enter a value such as 10.

3. For Page size, enter the number of objects to be returned with each page—e.g., 1,000.

4. Under Search Call Type, select Paged.

5. Click OK.

6. A page of results (i.e., 1,000 entries) will be displayed each time you click on Run until all results have been returned.

Using a command-line interface

> dsquery * <BaseDN> -limit 0 -scope <Scope> -filter "<Filter>" -attr "<AttrList>"

Using VBScript

' This code enables paged searching
' ------ SCRIPT CONFIGURATION ------
strBase    =  "<LDAP://<BaseDN>>;"
strFilter  = "<Filter>;"
strAttrs   = "<AttrList>;"
strScope   = "<Scope>" ' ------ END CONFIGURATION --------- set objConn = CreateObject("ADODB.Connection") objConn.Provider = "ADsDSOObject" objConn.Open "Active Directory ...