ADSI command is only pulling back 1500 values.

Question

We are using ADSI to pull current members and another attribute and comparing the two attributes. To give some background, we are using this other attribute to house a controlled list of members. This is for compliance reasons. Both attributes are native AD multivalue attributes. If I pull the ad group members using "get-admgroupmember" this number is correct. If I pull just the attribute value using get-admgroup $group -AdaxesService $server -Properties $attribute | Select -expand $attribute, I only get back 1500 values. If I run the same command with the native AD commandlet (get-adgroup), I get back the right number.

I would like to run the ADSI command ($Context.TargetObject.GetEx("Member")) because they seem to be much faster. Is there a possibility of expanding the amount of values that get pulled?

Answer 1

Hello Mark,

To obtain all the members of a group bypassing the 1500 limitation, you need to use Adaxes virtual properties adm-DirectMembersGuid and adm-MembersGuid. The first property is used to retrieve only direct members of a group while the second one is used to retrieve all group members including members of nested groups. For scripts executed via the Run a program or PowerShell script action (e.g. in a custom command configured for the Group object type) the code will be as follows:

$directMembers = $Context.TargetObject.GetEx("adm-DirectMembersGuid")

$allMembers = $Context.TargetObject.GetEx("adm-MembersGuid")

If you need to execute the script outside Adaxes, have a look at the following samples in our SDK: http://adaxes.com/sdk/SampleScripts.GettingGroupMembers.

Comments

Ok that will work for Members but what about other attributes/properties?

---

Hell Mark,

Sorry for the confusion, but we are not sure what exactly you mean. What attribute are you using? How are values stored in it? The thing is that, per our check by default it is not possible to have a multi-valued attribute with 1500 values. This restriction comes from Active Directory, not Adaxes.

---

No problem. We have a custom AD attribute that has been created exactly like the Member/MemberOf attributes called linked attributes. They can contain over 1500 values. We are using it as a "controlled" list of users that should be members. If someone is added to a group using the wrong process, we check it against this controlled list.

---

Thoughts?

---

I never got an answer on this. Any updates? Thank you.

---

Hello Mark,

Sorry for the confusion, but we are still not sure what exactly you need to achieve. As per our check, it is not possible to have a multi-valued non-DN syntax attribute with 1500 or more values. Could you, please, specify what exactly you store, how and what attribute(s) is used?

---

The memberOf attribute is a type of attribute called a linked attribute. There are others but this is a multi-valued linked attribute. This allows the object to contain more than 1500 values in AD. We created a similar one here to contain the "controlled" members of the group. We then check the controlled members against the members to determine if the person should be in the group or not. We then add or remove in order to get the list back to its controlled values.

Here is a microsoft document on linked and non-linked attributes. https://social.technet.microsoft.com/wiki/contents/articles/31919.active-directory-non-linked-multi-valued-attribute-size-limits.aspx

Also, the values are DNs in the custom attribute, just like members.

---

Hello Mark,

Thank you for the provided details. In this case, you will need to perform a search in the values of the required attribute. It can be done using the below script. In the script, the $attributeName variable specified the LDAP name of the attribute to search in.

$attributeName = "MyDNAttribute" # TODO: modify me

# Search parameters
$firstGroup = $Context.BindToObjectByDN("%distinguishedName%")
$firstGroup.SearchFilter = "(objectClass=*)"
$firstGroup.SearchScope = "ADS_SCOPE_BASE"
$firstGroup.PageSize = 500
$firstGroup.AttributeScopeQuery = $attributeName

try
{
    # Execute search
    $searchIterator = $firstGroup.ExecuteSearch()
    $searchResults = $searchIterator.FetchAll()
}
finally
{
    # Release resources
    if ($searchIterator){ $searchIterator.Dispose() }
}