Active Directory Cookbook

4.23. Modifying the Default LDAP Query Policy

Problem

You want to view or modify the default LDAP query policy of a forest. The query policy contains settings that restrict search behavior, such as the maximum number of entries that can be returned from a search.

Solution

Using a graphical user interface

1. Open ADSI Edit.

2. In the Configuration partition, browse to Services → Windows NT → Directory Service → Query Policies.

3. In the left pane, click on the Query Policies container, then right-click on the Default Query Policy object in the right pane, and select Properties.

4. Double-click on the lDAPAdminLimits attribute.

5. Click on the attribute you want to modify and click Remove.

6. Modify the value in the Value to add box and click Add.

7. Click OK twice.

Using a command-line interface

To view the current settings, use the following command:

> ntdsutil "ldap pol" conn "con to server <DomainControllerName>" q "show values"

To change the MaxPageSize value to 2000, you can do the following:

> ntdsutil "ldap pol" conn "con to server <DomainControllerName>" q
ldap policy: set MaxPageSize to 2000
ldap policy: Commit Changes

Using VBScript

' This code modifies a setting of the default query policy for a forest ' ------ SCRIPT CONFIGURATION ------ pol_attr = "MaxPageSize" ' Set to the name of the setting you want to modify new_value = 1000 ' Set to the value of the setting you want modify ' ------ END CONFIGURATION --------- Const ADS_PROPERTY_APPEND = 3 Const ADS_PROPERTY_DELETE = 4 set rootDSE = GetObject("LDAP://RootDSE") ...