{"id":71583,"date":"2004-08-24T11:46:00","date_gmt":"2004-08-24T11:46:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2004\/08\/24\/why-doesnt-my-search-return-all-my-user-accounts\/"},"modified":"2004-08-24T11:46:00","modified_gmt":"2004-08-24T11:46:00","slug":"why-doesnt-my-search-return-all-my-user-accounts","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/why-doesnt-my-search-return-all-my-user-accounts\/","title":{"rendered":"Why Doesn't My Search Return All My User Accounts?"},"content":{"rendered":"

\"Hey,<\/p>\n

Hey, Scripting Guy! I\u2019m trying to pull a list of all my users out of Active Directory. I\u2019m using ADO to search for these users, but no matter what I do I can only get 1,000 user names, even though we probably have 10 times that many user accounts. What could I be doing wrong?<\/p>\n

— MC, Athens, GA<\/p>\n

\"Spacer\"\"Hey,\"Script<\/a><\/p>\n

Hey, MC. Boy, if we had a nickel for every time we\u2019ve been asked this question we\u2019d have – well, OK, we\u2019d have a nickel. But that\u2019s only because we just started doing this column; trust us, this is a question that gets asked all the time.<\/p>\n

What you\u2019re running into here is a default built into Active Directory: by default, any time you run a query against Active Directory you only get back the first 1,000 objects. That\u2019s it. It doesn\u2019t matter how many objects you actually have in Active Directory, it doesn\u2019t matter how much memory you have on your domain controllers, nothing matters except this: you only get back the first 1,000 objects.<\/p>\n

Fortunately, though there\u2019s an easy workaround. Here\u2019s a script that returns all<\/i> the user accounts in Active Directory. Yes, we said all; if you have 100,000 user accounts, this script will return all of them:<\/p>\n

On Error Resume Next\nConst ADS_SCOPE_SUBTREE = 2\nSet objConnection = CreateObject(\"ADODB.Connection\")\nSet objCommand =   CreateObject(\"ADODB.Command\")\nobjConnection.Provider = \"ADsDSOObject\"\nobjConnection.Open \"Active Directory Provider\"\nSet objCommand.ActiveConnection = objConnection\nobjCommand.Properties(\"Page Size\") = 1000\nobjCommand.Properties(\"Searchscope\") = ADS_SCOPE_SUBTREE\nobjCommand.CommandText = _\n    \"SELECT Name FROM 'LDAP:\/\/dc=fabrikam,dc=com' \" & _\n        \"WHERE objectCategory='user'\"\nSet objRecordSet = objCommand.Execute\nobjRecordSet.MoveFirst\nDo Until objRecordSet.EOF\n    Wscript.Echo objRecordSet.Fields(\"Name\").Value\n    objRecordSet.MoveNext\nLoop\n<\/pre>\n
So what\u2019s the secret? The secret is the line that sets the Page Size to 1000. What\u2019s so special about that? Well, if you don\u2019t specify a Page Size, Active Directory returns only the first 1,000 items. If you do<\/i> specify a Page Size, however, Active Directory will return the first x<\/i> items, then pause for a split second and return the next x<\/i> items, then pause for a split second, and so on. This will continue until all the items have been returned. In this example, we set the Page Size to 1,000 (the maximum), so we\u2019ll get the first 1,000 items, there will be a (typically imperceptible) pause, then we\u2019ll get the next 1,000 items. That will continue until all the items have been returned.<\/p>\n
For more information about using scripts to search Active Directory, see this previously-recorded Scripting Guys’ webcast<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! I\u2019m trying to pull a list of all my users out of Active Directory. I\u2019m using ADO to search for these users, but no matter what I do I can only get 1,000 user names, even though we probably have 10 times that many user accounts. What could I be doing wrong? […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,5],"class_list":["post-71583","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! I\u2019m trying to pull a list of all my users out of Active Directory. I\u2019m using ADO to search for these users, but no matter what I do I can only get 1,000 user names, even though we probably have 10 times that many user accounts. What could I be doing wrong? […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/71583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=71583"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/71583\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=71583"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=71583"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=71583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}