Lightweight Directory Access Protocol Clients that use the DirectorySearcher class to query the Active Directory directory service may receive an incomplete result set (833789)

RESOLUTION

Software update information

A supported software update is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This software update may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next .NET Framework 1.1 service pack that contains this software update.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the software update. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;[LN];CNTACTMS

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

No prerequisites are required.

Restart requirement

You do not have to restart your computer after you apply this software update.

Software update replacement information

This software update does not replace any other software updates.

File information

The English version of this software update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version       Size    File name
   ----------------------------------------------------------------------
   17-Dec-2003  20:18  1.1.4322.982  90,112  System.directoryservices.dll

MORE INFORMATION

Note This software update is installed on a Windows client and not on the Microsoft Windows Server 2003 Domain Controller.

Performing an LDAP paged search is similar to requesting a bookmark for your query from the server. One large result set is separated into "chunks" of a size that the LDAP client specifies. Each chunk is sent to the client together with a cookie (or bookmark). The cookie determines where the next set of results can be retrieved by the server. When the full result set has been returned, the client issues a cookie with no value.

When the Active Directory server runs low on resources, or when the server is sent a query that is not correctly indexed, or both, the time that it takes to fulfill the query may extend beyond the limits that are set by the LDAP policy for the Active Directory forest. In this case, the server returns an empty result set but, in the case of a paged search, the server still returns a cookie with a value bookmark. The client can interpret this to mean that there is more data but the server cannot send it at the moment.

The functionality of the System.DirectoryServices namespace is built upon layers. The Microsoft implementation of the LDAP standard that is contained in the Wldap32.dll library is typically referred to as the LDAP API. Active Directory Service Interfaces (ADSI) is a Microsoft Component Object Model (COM) abstraction layer that sits on top of the LDAP API. In turn, the .NET System.DirectoryServices namespace is a managed assembly that sits on top of the native ADSI libraries.

The following Microsoft Knowledge Base article describes how to retrieve additional information from the Active Directory directory service in the situation that this article describes.

325189 Description of truncated results when you call the IDirectorySearch::GetNextRow function

However, .NET System.DirectoryServices does not check for the ERROR_MORE_DATA value by calling the ADsGetLastError function. Instead, the .NET application must perform this check. The software update in this article provides an optional way to have the .NET System.DirectoryServices perform this check on behalf of the .NET LDAP client by using the configuration file, the Machine.config file, the Application.config file, or the Web.config file.

The new code in this software update looks for a waitForPagedSearchData value in a configuration file. If the waitForPagedSearchData value does not exist or is false, the LDAP .NET client does not try to continue the paged search by reissuing the request. Instead, the LDAP Client throws an interopt COM exception that is similar to the following exception: System.Runtime.InteropServices.COMException (0x800700EA): More data is available at System.DirectoryServices.ResultsEnumerator.MoveNext() If the waitForPagedSearchData value is true, the client continues to issue paged LDAP searches and return the bookmarks to the server until the whole result set has been returned or until an error result occurs that is not ERROR_MORE_DATA.

Instructions for creating a configuration file

Create an <application name>.config file in the same directory where the application is located. If your application is called App.exe, name your file App.exe.config. Add the following code as the contents of this .config file:

<?xml version="1.0" encoding="UTF-8" ?>
<configuration>
<configSections>
<section name="system.directoryservices" type="System.DirectoryServices.SearchWaitHandler, System.DirectoryServices, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</configSections>
<system.directoryservices>
<DirectorySearcher waitForPagedSearchData="true" />
</system.directoryservices>
</configuration>

Make sure that the version matches the version that you are working with.