ADSIEdit 0x8000500d property not found

Some LDAP instance - connection through AdsiEdit - it is not a problem with authentication - my ldap account allowing me to connect. Problem with encryption? I don't think so, so what the hell it is?

memory considerations for Active Directory

Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

Name: EDB max ver pages (increment over the minimum)
Type: REG_DWORD
Value:
Note The value for the setting is the number of 16KB memory chunks (or 32KB memory chunks on a 64-bit processor) that will be reserved. For example:
9600 = ~150 MB 32-bit, ~600 MB 64-bit
12800 = ~200 MB 32-bit, ~800 MB 64-bit
16000 = ~250 MB 32-bit, ~1000 MB 64-bit
19200 = ~300 MB 32-bit, ~1200 MB 64-bit

When to increase? When allocated buckets are on high values...

performance tunning for Active Directory

NTDS\Request Latency - should be as low as possible - at the end is the defined timeout - by default - 120 seconds, but we don't want to be there...
Number of LDAP threads - by default is 4 per cpu core, so in environment with 4 cores is 16 - so if we have current value of 16 and cpu use at 100% so maybe we have bottleneck? CPU queue is another sign of issues.
NTDS\Estimated Queue Delay - shoud be 0 - is higher we have a problem - querries are wainting to process

ldap querries are not paged? Windows Active Directory

case:

java code

forest Active Directory in 2016 version, one parent, two children

java code querrying root domain (parent) for group (universal) in child1 domain

group has got members from child2 domain

uri ldap://parent

only first 1000 members are returned

ldap policy for returning 1500 objects means that 1500 will be returned, paging is not working

possible reason? referrals are not paged so it is prevention against resoure exhaustion of querried domain controller - I've seen it in Technet, but... I can't remember where... maybe on Oracle JNDI?

ADAM - LDS - how to authenticate/create accounts

Just for remember - every account created in ADAM/LDS is disabled by default. There is the dedicated attribute ms-DS-User-Account-Disabled which should be - if we want to use this account to login/authenticate - switch from default 'true' to 'false'. I spent too many hours to guess why I've got strange LDAP errors 49 with strange codes and sometime message said that is something wrong with account.

Monitoring LDAP querries

Enable Field Engineering - HKEY_LOCAL_MACHINE → SYSTEM → CurrentControlSet → Services → NTDS → Diagnostics. Set '15 Field Engineering' to '5'

Event ID 1643: No. of LDAP searches.

event ID 2889: unsecure ldap bind

event ID 2887: daily unsecure ldap binds

event ID 1644: recent ldap query

event ID 1535: error from ldap server

event ID 1317: ldap timeout
HKEY_LOCAL_MACHINE → SYSTEM → CurrentControlSet → Services → NTDS → Parameters
Inefficient Search Results Threshold, REG_DWORD - default 1000 - how many entries should be returned to treat is like inefficient,
Expensive Search Results Threshold, REG_DWORD - default 10000 - like inefficients
Search Time Threshold (msecs), REG_DWORD - default 30000 - how long query must take to be stored in event log as 1644 event id

to use AD LDS (previously ADAM) or not?

Why to use (in 2018/2019) LDS service if we have ADFS, Active Directory and clouds? From my experience in IT:

• it is much easier (mentally) to extend schema in dedicated directory service nor in Active Directory
• there are many older applications or they want just use LDAP not ADFS and You want do it more secure than giving access to production directory service
• you can have multiple instances of the same data or with different settings and scopes of attributes, for example You can give only login names and phone numbers for company A and the same data with group membership for company B without access to not needed data
• it is very lightweight - of course - if You will create application with wrong long queries You can kill every server - I saw it at one company - they didn't use group membership info and they try to find membership by browsing groups - one by one to find in which groups user is a member of. They have 20-40k users and 25k groups so please, imagine, how can it work. After my review I pointed them, that memberof property is available in OpenLDAP, AD LDS and almost in every modern directory service.
• it can be fully separated from main domain in scenario with publishing data in not secure environment - passwords can be sychronized as well

LDAP error codes

LDAP: error code 49 - 80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 52e, v1db1 ​
525​ user not found ​
52e​ invalid credentials ​​
530​ not permitted to logon at this time​​
531​ not permitted to logon at this workstation​​
532​ password expired ​​
533​ account disabled ​​
701​ account expired ​​
773​ user must reset password ​​
775​ user account locked​

LDAP optimization - domain controllers

From KB315071 Instructions for configuring per domain controller or per site policy

Create a new query policy under:
CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,forest root
Set the domain controller or site to point to the new policy by entering the distinguished name of the new policy in the "Query-Policy-Object" attribute. The location of the attribute is a follows:

The location for the domain controller is:
CN=NTDS Settings, CN=DomainControllerName, CN=Servers,CN=site name,CN=Sites,CN=Configuration,forest root
The location for the site is:
CN=NTDS Site Settings,CN=site name,CN=Sites,CN=Configuration,forest root

ldifde -i -f ldappolicy.ldf -v -c DC=X DC=forest root

dn: CN=Extended Timeout,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=X
changetype: add
instanceType: 4
lDAPAdminLimits: MaxReceiveBuffer=10485760
lDAPAdminLimits: MaxDatagramRecv=1024
lDAPAdminLimits: MaxPoolThreads=4
lDAPAdminLimits: MaxResultSetSize=262144
lDAPAdminLimits: MaxTempTableSize=10000
lDAPAdminLimits: MaxQueryDuration=300
lDAPAdminLimits: MaxPageSize=1000
lDAPAdminLimits: MaxNotificationPerConn=5
lDAPAdminLimits: MaxActiveQueries=20
lDAPAdminLimits: MaxConnIdleTime=900
lDAPAdminLimits: InitRecvTimeout=120
lDAPAdminLimits: MaxConnections=5000
objectClass: queryPolicy
showInAdvancedViewOnly: TRUE 

measure ldap bind time - for Active Directory powershell script

How to check simple bind anonymously for all domain controllers? Maybe using this script:

#####################Variables#####################
$repeats = 10
###################################################

#####################Main#####################
import-module activedirectory 
cls 
$myForest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() 
$domCtrls = $myforest.Sites | % { $_.Servers } | Select Name 
$domCtrls | %{
    $domCtrl = $_
    $totalTime = 0
    $i = 0
    $maxTime = 0; $minTime = 100
    while ($i -ne $repeats) {
        $c = New-Object System.DirectoryServices.Protocols.LdapConnection ($domCtrl.Name + ":389")
         
        # Anonymous, Basic, Digest, DPA (Distributed Password Authentication), 
        # External, Kerberos, Msn, Negotiate, Ntlm, Sicily 
        $c.AuthType = [System.DirectoryServices.Protocols.AuthType]::Anonymous

        $c.SessionOptions.ProtocolVersion = 3
        $c.SessionOptions.SecureSocketLayer = $false

        $time = (Measure-Command {$c.Bind()}).TotalSeconds
        $c.Dispose()

        $totalTime += $time 
        if ($minTime -gt $time) { $minTime = $time }
        if ($maxTime -lt $time) { $maxTime = $time }
        $i++
    }
    $avgTime = $totalTime / $repeats 
    $domCtrl.name + "`t" + $minTime + "`t" + $avgTime + "`t" + $maxTime
}

Output is formatted with tabs co You can copy/paste strictly to Excel or to Word and convert to a table.