Increase the maximum number of values for an attribute in Active Directory 2008r2

i have 2008r2 forest uses custom attribute has reached limit of values.  whenever try add new value following error:

administrative limit exceeded (11) administrative limit exceeded
ldapexception: server message: 00002024: svcerr: dsid-0205053d, problem 5008 (admin_limit_exceeded), data -1026

google provides no insight and dsid-0205053d doesn't seem appear anywhere.  any appreciated.

thanks

marc

i learned lot investigating this. turns out there limit. far have found no microsoft documentation, these links explain some:

https://social.technet.microsoft.com/forums/en-us/fea67c92-8dab-4711-8579-baaee4bca3f7/the-administrative-limit-for-this-request-was-exceeded?forum=identitylifecyclemanager

http://blogs.technet.com/b/ad/archive/2008/12/19/too-much-of-a-good-thing.aspx

i believe limit applies multi-valued attributes not linked. purpose limit replication traffic. 1 workaround use linked attribute. think because such attributes use lvr (linked value replication), @ least since windows server 2003, whereby values have changed replicated rather entire attribute. member attribute of groups , memberof attribute of users linked, explains why groups can have millions of users.

the relevant value not rangeupper, rather size property see in the documentation ad attributes here:

https://msdn.microsoft.com/en-us/library/ms675090(v=vs.85).aspx

for example, size listed attribute msds-allowedtodelegateto (mentioned in blog post linked above) 0-64k. cannot find attribute of attribute object (in schema container) accounts this. size listed proxyaddresses attribute testing has no value. maybe means no limit.

i used dsastat utility (as suggested in blog post above) check bytes per object test user, added values proxyaddresses attribute. shows size attribute object specified. in case result 4128 bytes, of course since size not set, assume there no limit. however, can use dsastat see how big object attribute is. syntax be:

dsastat -b:<distinguished name of object or ou> -gcattrs:<ldapdisplayname of attribute>

if specify ou or container, utility analyzes objects in container (which can take awhile), best specify 1 object. example:

dsastat -b:cn=jimsmith,ou=west,dc=mydomain,dc=com -gcattrs:proxyaddresses

the workarounds suggested in links above are not real good. 1 use linked attribute instead (which uses lvr) there no limit. involves adding 2 attributes schema, forward link (similar member attribute of group objects) , link (similar memberof attribute of users, computers, contacts, , groups). remove entries in multi-valued attribute.

i not know means if size listed in link above documenting attributes not set. example, don't know if there limit applies proxyaddresses attribute. finally, don't know size property comes from. if attribute custom, won't listed in link, don't know (yet) how can determine size is.

---

richard mueller - mvp directory services

Windows Server  >  Directory Services