tymm654 has asked for the wisdom of the Perl Monks concerning the following question:

found it...

The key to this functionality is performing a separate search for each range of multi-valued attributes. I was attempting to pull ranges 0-1499, 1500-3499, etc. all in the same search (which doesn't work).

### BEGIN code added to the paged callback sub foreach my $var (@attr_list) { if ($var =~ /;range=/) { ### $var will look like this --> "member;range=0-1499" ($var,my $range) = split /;/, $var; ($junk,$range) = split /=/, $range; my ($first,$last) = split /-/, $range; ### if $last eq "*", indicates this is the last range incre +ment, and ### we do not need to perform another supplemental search if ($last ne "*") { my $range_diff = ($last - $first) + 1; my $increment = $last + $range_diff; $last = $last + 1; my $push_line = $var."|".$last."|".$increment."|".$sub +_obj->dn; push(@supp_srch,"$push_line"); } } ### if $var matches range pattern ### END code added to the paged callback sub

The following code accomadates lines being added to @supp_srch from the secondary searches. The $last variable isn't really used below. That was included just so I could test my simple math in the callback sub code above. I added this block right after my inital search

foreach my $line (@supp_srch) { chomp($line); ($att_val,$first,$last,$dn) = split /\|/, $line; $attributes = ['cn','displayName','groupType','description', "mem +ber;range=${first}-*"]; my $mesg = LDAP_PageSearch ( $ldap, "(&(objectclass=group)(!(obje +ctclass=computer)))", $attributes , "$dn" ); }
  • Comment on Net::LDAP retrieval of Active Directory group members (multi-valued attributes that exceed the server side limit.)
  • Select or Download Code

Replies are listed 'Best First'.
Re: Net::LDAP retrieval of Active Directory group members (multi-valued attributes that exceed the server side limit.)
by NetWallah (Canon) on Nov 21, 2011 at 22:39 UTC
    Most likely, you are running into this limit: (From MS KB 315071):
    MaxValRange - This value controls the number of values that are returned for an attribute of an object, independent of how many attributes that object has, or of how many objects were in the search result. In Windows 2000, this control is "hard" coded at 1,000. If an attribute has more than the number of values that are specified by the MaxValRange value, you must use value range controls in LDAP to retrieve values that exceed the MaxValRange value. MaxValueRange controls the number of values that are returned on a single attribute on a single object.

    Default value:

    • Windows 2000 - 1,024
    • Windows Server 2003 - 1,500
    You will probably need to fix it in AD, using ntdsutil.

                "XML is like violence: if it doesn't solve your problem, use more."

Re: Net::LDAP retrieval of Active Directory group members (multi-valued attributes that exceed the server side limit.)
by Anonymous Monk on Sep 18, 2013 at 16:53 UTC

    See Net::LDAP::FAQ "How do I search for all members of a large group in AD?" for a working example using Microsoft's range option when searching.