LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Server Administrator's Guide
It may be possible to rewrite these applications so that an LDAP search request is used instead
of a call to getpwent or getgrent.
Search Limits
The default configuration for Active Directory sets the search size limit to 1,000 entries and the
search time limit to two minutes. Setting search limits prevents users from consuming all the
resources of a directory and helps to minimize "denial of service" attacks; however, on large
databases they will not be enough to service commands or applications that generate enumeration
requests. You can use the support tool ntdsutil to change these two values. ntdsutil can be
installed from the Windows 2000 or 2003 Server CD in the \SUPPORT\TOOLS folder.
NOTE: The search time limit set during the setup procedure specifies the search timeout on
the client side. To service enumeration requests, this parameter may need to be adjusted
accordingly.
1. On your domain controller, click Start, then Run.
In the Open box, enter ntdsutil, then click OK.
2. Enter ldap policies, and then press the Enter key. You can enter the ? symbol at any of
the prompts in the ntdsutiltool to see a list of available commands.
3. Enter connections, and then press the Enter key.
4. Enter connect to server <servername>, where <servername>is the name of server
you want to use, and then press the Enter key.
5. At the server connections: prompt, enter quit, and then press the Enter key.
6. Enter set maxpagesize to <size>, where the <size> is the maximum number of
search objects that you want the Active Directory to return for a search, and then press the
Enter key.
7. Enter set maxqueryduration to <time>, where the <time> is the maximum number
of seconds to wait for a search request to complete, and then press the Enter key.
8. Enter show values then press the Enter key. This verifies the new values are set correctly.
9. Enter Commit Changes, and then press the Enter key.
10. Enter quit then press the Enter key to quit ldap policies.
11. Enter quit then press the Enter key to quit ntdsutil.
Search Filter
If enumeration requests cannot be avoided, consider the use of customized search descriptors
for each of your name services. Customized search descriptors can improve enumeration cases
because it limits the search only to the paths (containers) where the required data resides.
For example, if your default search DN is set to your domain root DC=cup, DC=hp, DC=com,
you can improve performance if you change the search base DN to search user and group
information toCN=Users, DC=cup, DC=hp, DC=com for the passwd and group services.
Client Daemon Performance
Compared to previous networked name service systems, LDAP directory servers support a
number of new features. And the general purpose nature of LDAP allows it to support a variety
of applications, beyond those just used by a networked OS. Although directory servers have
excellent performance and scalability, the addition of these features, such as security, means that
directory applications will benefit from a design that considers performance requirements. In
order to maximize of the number of HP-UX clients that can be supported by an LDAP directory
server, and also improve client response, the ldapclientd daemon supports both data caching
and persistent network connections. Their use, benefits and side-effects are described below.
126 Administering LDAP-UX Client Services