regulating/restricting large LDAP queries in AD

[MJanssen01]

Hi,
More and more applications are able to use LDAP queries to retrieve information from Active Directy and use this info for the application.. In principle this is a good thing but....

At the moment we're experiencing performance issues (response times of DC's)because of applications running large queries against AD. Because we don't have any control over the implementation of such applications we need something to regulate(=restrict) the possibility of running large queries. Any ideas on how to achieve this (other then not giving them a domain user account)

thanx,

 

[ntinlin]

This might prove useful. Although most people would probably be wanting to increase some of the limits not decrease them.

How to view and set LDAP policy in Active Directory by using Ntdsutil.exe

http://support.microsoft.com/default.aspx?scid=kb;en-us;315071&sd=tech

 

[MJanssen01]

Hi,

Thanx for the reply... Yes, I've seen this article before... It's definitely an option if you wanted to regulate queries on a domain or site level. The ideal situation would be that you could link a securitygroup/users to that policy with rights to do large queries on AD.

That way anybody who wants to use custom build applications/queries on AD has to arrange the appropriate permissions with us to run large queries. Anyway, All were doing is finding a solution for a symptom. The real problem is poorly written software ;-) but that's not something we can change.

Have a look at the possible results in the link below

http://www.petri.co.il/anonymous_ldap_operations_in_windows_2003_ad.htm

 

[PScottC]

Consider placing a Dedicated DC in an isolated "Site" in AD. Then point all the servers that are querying AD to that server. By isolating the site, you can prevent normal authentication traffic. There are also some GPO policies that you can set up to prevent authentication traffic, but I think that this would be easier.

This of course is another bandaid, but at least users will be able to log in.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers