What are the known limitations when dealing with Organizational Units or Groups with many thousands of objects? (4333860)

Some environments may be organized in such a way that Organizational Units (OU's) or Groups may contain many thousands of objects.

In some environments, performance issues or errors have been noted when performing Find requests or attempting to display OU's and groups in excess of 10,000 objects. Similar issues are usually noted in the native Microsoft utilities in these cases. Some environments may encounter similar issues with Managed Units and Dynamic Groups queries which result in memberships in excess of 10,000 objects.

The largest impact to performance in extremely large environments is the connection to the Domain controller designated as the DirSync Server. In extremely large and complicated environments, it is strongly suggest to configure a dedicated DirSync server for use with ActiveRoles Server, with a low-latency connection in the same datacenter or on the same Virtual Machine host. For more information regarding configuring a DirSync server please see Changing DirSync Server and Operational Domain Controller from within ARS

For more information regarding monitoring and possibly improving performance in Active Directory, please see Monitoring Performance in Active Directory or contact Microsoft.

WORKAROUND 1

In the Active Roles Console, by default, the Maximum number of items displayed per folder is set to 2000. This can be adjusted by selecting View | Filter Options.

Performance can be impacted in the Active Roles Console when the Advanced Details Pane is enabled while viewing a large number of objects. This can be alleviated by deselecting View | Advanced Details Pane

WORKAROUND 2

The simplest and most robust Active Roles Client is the Active Roles Management Shell. It is also the only Active Roles Client which can target Active Directory natively.

Using the -SizeLimit 0 parameter in the Active Roles Management Shell allows viewing and/or exporting an Organizational Unit or Group of any size.

For example, the following cmdlet can export a group with any number of members:

Get-QADGroupMember -Identity 'GroupName' -Indirect -SizeLimit 0 | Select-Object samAccountName, distinguishedName | Export-CSV -Path “GroupMembers.csv” -NoTypeInformation