Directory Services

Enumerating Groups That Contain Many Members

The members of a group are stored in a multi-value property called member. The group membership can contain a large number of values. Enumerating members can be inefficient when the number of values in a multi-valued attribute becomes large. The server will also limit the maximum number of values that can be retrieved in a single query. This means that if a group may have more members than can be supplied by the server, the only way to enumerate all members is to use incremental retrieval of data, known as range retrieval.

The version of the server that supplies the requested data determines the maximum number of values that can be retrieved in a single query. The following table lists the server version and the maximum number of values that can be retrieved in a single query.

Server Version Maximum Values Retrieved
Windows 2000 1000
Windows Server 2003 family 1500

Range retrieval involves requesting a limited number of property values in a single query. The number of values requested must be less than, or equal to, the maximum number of values supported by the server. To reduce the number of times the query must contact the server, the number of values requested should be as close to this maximum as possible. To enable an application to work correctly with all servers, a maximum number of 1000 should be used.

The range specifiers for a property query require the following form:

range=<low range>-<high range>
where <low range> is the zero-based index of the first property value to retrieve and <high range> is the zero-based index of the last property value to retrieve. Zero is used for <low range> to specify the first entry. The wildcard character (*) can be used for <high range> to specify all remaining entries.

The following table lists examples of range specifiers.

Example Meaning
range=0-* Retrieve all property values. This is subject to limits imposed by the server.
range=0-500 Retrieve the 1st to 501st values inclusively.
range=2-3 Retrieve the 3rd and 4th values.
range=501-* Retrieve the 502nd and all remaining values. This is subject to limits imposed by the server.

There are several different ways to retrieve a range of property values. The IADs::GetInfoEx method can be used in either an automation language or C++. The IADs::GetInfoEx method is the preferred method of performing range retrieval. For more information about using IADs::GetInfoEx for range retrieval, see Using IADs::GetInfoEx for Range Retrieval.

If an automation language is used, the ActiveX Directory Objects (ADO) can be used to retrieve a range of property values. For more information about using ADO for range retrieval, see Using ADO for Range Retrieval.

If C++ is used, the IDirectorySearch and IDirectoryObject interfaces can be used to retrieve a range of property values. For more information about using IDirectorySearch and IDirectoryObject for range retrieval, see Using IDirectorySearch and IDirectoryObject for Range Retrieval.