Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Doing performance testing on an AD-LDS (Server 2008 R2 64 bits), we created a milion user in a single OU. We also created a single group object and made those milion users member of that group.

When we try to list the milion of users ADSIEdit times out with an error message saying it cannot display that many users. Fine.

But if we open the properties for the group, ADSIEdit freezes, eating up all available memory and CPU trashing (nearly 60M page faults in under an hour).

AD-LDS (running on another computer) is barely hitting the 1% CPU mark, servicing other ldap requests as if nothing were.

We can throw more memory at the problem, but more users will have to be managed one day and we will be back at square one.

Is there a way to set a limit in ADSIEdit so that it will not hang the computer when retreving a very large multi-value object ?

share|improve this question
Is there no subdivision of this group, could you nest several groups in the group? – Gent Sep 29 '12 at 2:24
We could bring it down to about 30k, but that's still too much for ADSI. We don't have much control over the third party software requiring such large groups. – ixe013 Sep 29 '12 at 2:52
up vote 2 down vote accepted

Is there a way to set a limit in ADSIEdit so that it will not hang the computer when retreving a very large multi-value object ?

Not that I'm aware of. LDAP is perfectly fine giving a small set of values for a multi-value attribute, but to my knowledge ADSIEDIT does not take advantage of that. Another tool will be better for managing such objects.

For a directory structure such as you describe managing things through scripting is probably the best way to go, rather than trust the GUI tools. The command-line tools that come with RSAT are very good at object manipulations, even for very large objects.

share|improve this answer
Indeed. LDP can also handle large objects. On an related note : installating LDS with the tools does not require a reboot, but installing the AD and AD-LDS tools requires a reboot – ixe013 Sep 29 '12 at 2:55
FYI, Microsoft support looked at it. ADSIEdit does try to allocate memory for all the data when it comes to attributes. Will not fix. – ixe013 Dec 4 '12 at 4:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.