LDP Query length

Question

I was wondering if anybody knows if there are limitations on the size of an LDAP query.
I have an application that is enumerating AD via group membership. Using the query (&(objectclass=group)(CN=Groupname*)) with Attribute of Member only pulls back the DN of the users where the application requires SamAccountName.
So. I have reversed the query and have searched for users that are memberof:
(&(objectclass=user)(| (Memberof=CN=Administrators,CN=Builtin,DC=Domain,DC=nonprod)( MemberOf=CN=APP_TH_Admin_DEV,OU=Groups,OU=User Groups,DC=Domain,DC=nonprod)))
This works in pulling back all members of each group
However, this statment does not...
(&(objectclass=user)(| (MemberOf=CN=APP_TH_ContentStudio_DEV,OU=Groups,OU=User Groups,DC=domain,DC=nonprod(MemberOf=CN=APP_TH_Admin_DEV,OU=Groups,OU=User Groups,DC=domain,DC=nonprod)))
The only thing I can think of is the size of the query?
Also, if anyone knows a way that you can pull back the SamAccountName from groups that would be even better :)
Cheers,
Sean

Answer 1

Glad to hear. I didn't know what the limit was but I didn't think length was the issue in that query ... take a look the length of some of the queries ADUC lets you create! For example, searching for users where the First Name starts with Mark and Department
starts with IT, ADUC generated this:
(&(&(|
(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))
(&(objectCategory=person)(!objectSid=*))
(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14)))
(objectCategory=user)(objectClass=user)(givenName=Mark*)(department=IT*)
When it could have been covered by this:
(&(samAccountType=805306368)(department=IT*)(givenName=Mark*))
ADUC is still useful for "how do I do this" and "does this work" questions though but maybe clean up the resulting query string a bit if you are going to use it in scripts, it'll make them a lot easier to read. I wouldn't want to type that first query into
a Get-AD* -Filter!! This site is very useful for this stuff:
http://www.selfadsi.org/extended-ad/search-user-accounts.htm
And search this link for "Default Values for LDAP Administrative Limits":
http://technet.microsoft.com/en-us/library/cc755809%28WS.10%29.aspx#w2k3tr_adsrh_how_lhjt If MaxReceiveBuffer is the limit, you've got 10MB to play with ;) And a potential 256MB for the results!
Mark