Use powershell to set LDAP MaxConnIdleTime

Question

I need a scripted solution (preferrably powershell) to modify the LDAP parameter called MaxConnIdleTime on Server 2016. I found that there is a command line executable called ntdsutil.exe, however, using ntdsutil to set the MaxConnIdleTime requires launching the program, and entering sub-menus to change the setting:

At the "ntdsutil:" prompt, enter "LDAP policies", At the "ldap policy:" prompt, enter "connections" , At the "server connections:" prompt, enter "connect to server [host-name]" (where [host-name] is the computer name of the domain controller), At the "server connections:" prompt, enter "q", At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to [new value]", Enter "Commit Changes" to save

Is it possible to script passing multiple commands to ntdsutil in sequence, or skip ntdsutil and modify the setting another way with powershell? I couldn't find any powershell cmdlets with this level of control over LDAP settings.

Answer 1

I found that multiple commands can be sent to ntdsutil in sequence. From powershell it is a one-line solution. To run this from a batch file, just remove the &.

& ntdsutil "LDAP policies" connections "connect to server [serverName]" quit "Set MaxConnIdleTime to [timeInSeconds]" "Commit Changes" quit quit

the key to solving this was the documentation at: https://ss64.com/nt/ntdsutil.html