Skip navigation

Working Around LDAP Administration Limits

You can use the ntdsutil.exe command (which is in the Support tools folder on the Win2K installation CD-ROM) to set the MaxPageSize LDAP policy to a higher number so that userstatusrpt.vbs returns all your users. For more details, refer to the Microsoft article "HOW TO: View and Set Lightweight Directory Access Protocol Policies by Using Ntdsutil.exe in Windows 2000" (http://support.microsoft.com/?kbid=315071).

If your users are divided among organizational units (OUs) that each contain no more users than the maximum number that an LDAP query can return, you can simply run the script for each OU. For example, if you have a top-level OU called Department and three OUs beneath it called IT, Engineering, and Sales, and all your users are divided among these OUs, you can run the script three times in succession, once for each OU. Each time, you would specify a different baseDN and a different output file as appropriate for that particular OU. Here are three sample commands that you would run one after the other to generate a complete report:

userstatusrpt.vbs "OU=IT,OU=Department,OU=DOMAIN,OU=COM" it.csv
userstatusrpt.vbs "OU=Engineering,OU=Department,OU=DOMAIN,OU=COM" eng.csv
userstatusrpt.vbs "OU=Sales,OU=Department,OU=DOMAIN,OU=COM" sales.csv
TAGS: Security
Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish