Platform SDK: Active Directory, ADSI, and Directory Services

Enumerating Groups That Contain Many Members

The members of a group are stored in a multi-valued property called member. The group membership may potentially contain a large number of values. This can be inconvenient or even impossible when the number of values in a multi-valued attribute becomes very large.

Active Directory supports incremental retrievals for this purpose. You may specify the range specifiers for multi-valued properties.

Range specifiers for a property take the following form:

attributename;Range=range

where attributename is the ldapDisplayName of the attribute and range is the range of values that you want to retrieve from the property. The * wildcard can be used to specify "to the end of the list" and 0 is used to specify the first entry in the list.

The following table contains examples of range specifiers.

Example Meaning
Member;Range=0-500 Retrieve entries from 0 to 500 inclusively. The maximum potential entries are 501 values.
Member;Range=2-3 Retrieve the 3rd and 4th entries.
Member;Range=501-* Retrieve the 502nd entry and beyond.

IDirectorySearch, IDirectoryObject, and ADO support range retrievals.