Recipe 4.23 Modifying the Default LDAP Query Policy

4.23.1 Problem

You want to view or modify the default LDAP query policy of a forest. The query policy contains settings that restrict search behavior, such as the maximum number of entries that can be returned from a search.

4.23.2 Solution Using a graphical user interface
  1. Open ADSI Edit.

  2. In the Configuration partition, browse to Services Windows NT Directory Service Query Policies.

  3. In the left pane, click on the Query Policies container, then right-click on the Default Query Policy object in the right pane, and select Properties.

  4. Double-click on the lDAPAdminLimits attribute.

  5. Click on the attribute you want to modify and click Remove.

  6. Modify the value in the Value to add box and click Add.

  7. Click OK twice. Using a command-line interface

To view the current settings, use the following command:

> ntdsutil "ldap pol" conn "con to server <DomainControllerName>" q "show values"

To change the MaxPageSize value to 2000, you can do the following:

> ntdsutil "ldap pol" conn "con to server <DomainControllerName>" q
ldap policy: set MaxPageSize to 2000
ldap policy: Commit Changes Using VBScript
' This code modifies a setting of the default query policy for a forest
pol_attr  = "MaxPageSize" ' Set to the name of the setting you want to modify
new_value = 1000          ' Set to the value of the setting you want modify
' ------ END CONFIGURATION ---------


set rootDSE = GetObject("LDAP://RootDSE")
set ldapPol = GetObject("LDAP://cn=Default Query Policy,cn=Query-Policies," & _
                "cn=Directory Service,cn=Windows NT,cn=Services," & _
                rootDSE.Get("configurationNamingContext") )
set regex = new regexp
regex.IgnoreCase = true
regex.Pattern = pol_attr & "="
for Each prop In ldapPol.GetEx("ldapAdminLimits")
   if regex.Test(prop) then
      if prop = pol_attr & "=" & new_value then
         WScript.Echo pol_attr & " already equal to " & new_value
         ldapPol.PutEx ADS_PROPERTY_APPEND, "lDAPAdminLimits", _
                    Array( pol_attr & "=" & new_value )
         ldapPol.PutEx ADS_PROPERTY_DELETE, "lDAPAdminLimits", Array(prop)
         WScript.Echo "Set " & pol_attr & " to " & new_value
      end if
      Exit For
   end if

4.23.3 Discussion

The LDAP query policy contains several settings that control how domain controllers handle searches. By default, one query policy is defined for all domain controllers in a forest, but you can create additional ones and apply them to a specific domain controller or even at the site level (so that all domain controllers in the site use that policy).

Query policies are stored in the Configuration NC as queryPolicy objects. The default query policy is located at: cn=Default Query Policy, cn=Query-Policies, cn=Directory Service, cn=Windows NT, cn=Services, <ConfigurationPartitionDN>. The lDAPAdminLimits attribute of a queryPolicy object is multivalued and contains each setting for the policy in name-value pairs. Table 4-4 contains the available settings.

Table 4-4. LDAP query policy settings


Default value



4 per proc

Maximum number of threads that are created by the DC for query execution.



Maximum number of datagrams that can be simultaneously processed by the DC.



Maximum size in bytes for an LDAP request that the server will attempt to process. If the server receives a request that is larger then this value, it will close the connection.


120 secs

Initial receive time-out.



Maximum number of open connections.


900 secs

Maximum amount of time a connection can be idle.



Maximum number of queries that can be active at one time.



Maximum page size that is supported for LDAP responses.


120 secs

Maximum length of time the domain controller can execute a query.



Maximum size of temporary storage that is allocated to execute queries.



Maximum size of the LDAP Result Set.



Maximum number of notifications that a client can request for a given connection.

Since the settings are stored as name/value pairs inside a single attribute, also referred to as AVAs, the VBScript solution has to iterate over each value and use a regular expression to determine when the target setting has been found. It does this by matching <SettingName>= at the beginning of the string. See Recipe 4.16 for more on AVAs.

You should not change the default query policy in production unless you've done plenty of testing. Changing some of the settings may result in unexpected application or domain controller behavior.

Instead of modifying the default LDAP query policy, you can create a new one. In the Query Policies container (where the default query policy object is located), create a new queryPolicy object and set the lDAPAdminLimits attribute as just described based on the settings you want configured. Then modify the queryPolicyObject attribute on the nTDSDSA object of a domain controller you want to apply the new policy to. This can be done via the Active Directory Sites and Services snap-in by browsing to the nTDSDSA object of a domain controller (cn=NTDS Settings), right-clicking on it, and selecting Properties. You can then select the new policy from a drop-down menu beside Query Policy. Click OK to apply the new policy.

4.23.4 See Also

MS KB 315071 (HOW TO: View and Set Lightweight Directory Access Protocol Policies by Using Ntdsutil.exe in Windows 2000)

    Chapter 3. Domain Controllers, Global Catalogs, and FSMOs
    Chapter 6. Users
    Appendix A. Tool List