Re: ldapsearch against AD for large groups (>1000 members)

[Michael Ströder <michael@stroeder.com>]

Antti Tikkanen wrote:
> I am not sure if this is an OpenLDAP thing or an AD thing.

Don't know the details about AD but I guess it's not an OpenLDAP 
issue since I used OpenLDAP client in a test to query a group 
entry with 200000 member values from Netscape DS 4.1x.

> When I use
> ldapsearch to get the members of an AD group with more than 1000 members,
> I only receive the first 1000:
>
>  # ldapsearch -LL '(cn=testgroup)'
>  
>  --clip--
>  
>   dn: CN=testgroup,<...>
>   member;range=0-999:CN=test999,<...>
>   member;range=0-999:CN=test998,<...>
>   member;range=0-999:CN=test997,<...>

Seems playing with the ;range sub-type when explicitly requesting 
attributes might be interesting...

But why do you want to retrieve all members? In most applications 
this does not scale very well anyway.

Ciao, Michael.