I need a scripted solution (preferrably powershell) to modify the LDAP parameter called MaxConnIdleTime on Server 2016. I found that there is a command line executable called ntdsutil.exe, however, using ntdsutil to set the MaxConnIdleTime requires launching the program, and entering sub-menus to change the setting:

At the "ntdsutil:" prompt, enter "LDAP policies", At the "ldap policy:" prompt, enter "connections" , At the "server connections:" prompt, enter "connect to server [host-name]" (where [host-name] is the computer name of the domain controller), At the "server connections:" prompt, enter "q", At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to [new value]", Enter "Commit Changes" to save

Is it possible to script passing multiple commands to ntdsutil in sequence, or skip ntdsutil and modify the setting another way with powershell? I couldn't find any powershell cmdlets with this level of control over LDAP settings.

  • I found an example in VB, so definitely doable in PS. Probably use Get-ADObject to get your ldapAdminLimits, then looping through to set the MaxConnIdleTime. VB_Example – Jeramy Aug 16 '20 at 14:10

I found that multiple commands can be sent to ntdsutil in sequence. From powershell it is a one-line solution. To run this from a batch file, just remove the &.

& ntdsutil "LDAP policies" connections "connect to server [serverName]" quit "Set MaxConnIdleTime to [timeInSeconds]" "Commit Changes" quit quit

the key to solving this was the documentation at: https://ss64.com/nt/ntdsutil.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.