LDAP-UX Client Services B.05.00 with Microsoft Windows Active Directory Server Administrator's Guide (obsolete beyond B.05.00)
6.17.2 Search limits
The default configuration for Active Directory sets the search size limit to 1,000 entries and the
search time limit to two minutes. Setting search limits prevents users from consuming all the resources
of a directory and helps to minimize "denial of service" attacks; however, on large databases they
will not be enough to service commands or applications that generate enumeration requests. You
can use the support tool ntdsutil to change these two values. ntdsutil can be installed from
the Windows 2003 R2/2008 Server CD in the \SUPPORT\TOOLS folder.
NOTE: The search time limit set during the setup procedure specifies the search timeout on the
client side. To service enumeration requests, this parameter may need to be adjusted accordingly.
1. On your domain controller, click Start, then Run.
In the Open box, enter ntdsutil, then click OK.
2. Enter ldap policies, and then press the Enter key. You can enter the ? symbol at any of
the prompts in the ntdsutiltool to see a list of available commands.
3. Enter connections, and then press the Enter key.
4. Enter connect to server <servername>, where <servername>is the name of server
you want to use, and then press the Enter key.
5. At the server connections: prompt, enter quit, and then press the Enter key.
6. Enter set maxpagesize to <size>, where the <size> is the maximum number of search
objects that you want the Active Directory to return for a search, and then press the Enter key.
7. Enter set maxqueryduration to <time>, where the <time> is the maximum number
of seconds to wait for a search request to complete, and then press the Enter key.
8. Enter show values then press the Enter key. This verifies the new values are set correctly.
9. Enter Commit Changes, and then press the Enter key.
10. Enter quit then press the Enter key to quit ldap policies.
11. Enter quit then press the Enter key to quit ntdsutil.
6.17.3 Search filter
If enumeration requests cannot be avoided, consider the use of customized search descriptors for
each of your name services. Customized search descriptors can improve enumeration cases because
it limits the search only to the paths (containers) where the required data resides.
For example, if your default search DN is set to your domain root DC=cup, DC=hp, DC=com,
you can improve performance if you change the search base DN to search user and group
information to CN=Users, DC=cup, DC=hp, DC=com for the passwd and group services.
6.18 Client daemon performance
Compared to previous networked name service systems, directory servers support a number of
new features. And the general purpose nature of LDAP allows it to support a variety of applications,
beyond those just used by a networked OS. Although directory servers have excellent performance
and scalability, the addition of these features, such as security, means that directory applications
will benefit from a design that considers performance requirements. In order to maximize of the
number of HP-UX clients that can be supported by a directory server, and also improve client
response, the ldapclientd daemon supports both data caching and persistent network connections.
Their use, benefits and side-effects are described below.
6.18.1 ldapclientd caching
Caching LDAP data locally allows for much greater response time for name service operations.
Caching means that data that has been recently retrieved from the directory server will be retrieved
from a local store, instead of the directory server. Caching greatly reduces both directory server
132 Administering LDAP-UX Client Services