Get-ADUser times out after 2 minutes

October 07, 2018 by Paul DeArment in PowerShell

This past week I was approached by a coworker that had a script which was timing out in less than 30 minutes - the default ADWS timeout. They were using get-aduser with a few conditions in the filter parameter, resulting in only about 30 user accounts being returned. The query was randomly timing out and there was no immediate clue as to why in the error message. This is being run against a complex ad environment with 80k+ users in the environment. After doing some searching around the error results from the timeout between paginated results. After finding this page the answer became obvious.

Because there are so few results being returned due to the filter in such a large environment - and the default pagination size is 256 results the timeout of two minutes is being hit. In this case - since there were only 30 or less results the pagination limit of 256 was never hit and therefore if the query took more than two minutes an error was returned. The simple solution is to reduce the number of results returned on each “page” of results by setting the parameter ResultPageSize to a lower number. In this case, because they were only expecting 30 / 80k+ users to be returned we set the ResultPageSize parameter to 1. This means that for each result returned, the two minute time limit is once again refreshed preventing the query from timing out.

Exchange 2010 and Active Directory Crashes Windows Powershell

September 05, 2018 by Paul DeArment in PowerShell

Normally there is not an issue importing the Active Directory module when using Exchange Remoting, but once in a while there are conflicts which cause the Windows PowerShell instance to crash. Sometimes unconventional workarounds fix the issue temporarily, at least enough to do your work. There were some good reminders that came out of this as well for the future.

ADWS Default Limit

August 17, 2018 by Paul DeArment in PowerShell

Active Directory Web Services has some default limits. When you run against those limits, how are you supposed to be able to continue working without modifying all of your production active directory servers? Going back to using ADSI allows you to work around these limitations, and when passing this back to the active directory CMDLTs you can perform the work you need.