Fix Active Directory error 0x00002046 (offset range)

Quick answer

Reduce your LDAP search filter to return fewer objects, or paginate the query using the LDAP_PAGED_RESULT_OID_STRING control.

What's going on here

Error 0x00002046 pops up when you run an Active Directory search that returns more objects than can fit in a single Win32 error code offset range. Think of it like trying to number every book in a library on a single slip of paper—the number gets too big. Windows caps the offset at about 2^31 (around 2.1 billion), but that's not the real limit. The real trigger is the server's MaxPageSize setting (default 1000 objects on older DCs, 5000 on newer ones). When your search hits that limit without pagination, the server throws this error.

You'll see this most often with tools like LDP.exe, ADSI Edit, or custom scripts pulling all users from a large domain. For example, running ldp.exe and doing a search without a filter on a domain with 10,000 users—bam, you get 0x00002046.

Fix it step by step

1. Identify the search tool or script that triggered it. Look at the exact LDAP query. Common culprits: (objectClass=user) without any other filter, or (objectCategory=person) without scope limits.
2. Narrow your search filter. Add a more specific filter to reduce results. For example, if you wanted users who logged in this week, use (&(objectClass=user)(lastLogonTimestamp>=133000000000000000)). After applying, test the search again—you should see fewer results and no error.
3. Set the LDAP search base to a smaller OU. Instead of searching the whole domain DC=contoso,DC=com, drill down to OU=Sales,DC=contoso,DC=com. This cuts the result set drastically.
4. Enable pagination in your LDAP client. Most tools let you set a page size. In LDP.exe, before clicking Search, go to Options > Connection Options, check Paged Search, set page size to 500. Then apply. The tool will fetch results in batches of 500 objects.
5. For PowerShell scripts, add -ResultPageSize 500 to Get-ADUser or Get-ADObject. Example: Get-ADUser -Filter * -ResultPageSize 500 -Properties *. This forces pagination and avoids the offset error.
6. Check and increase MaxPageSize on the domain controller (if you have admin access to all DCs). Open Active Directory Administrative Center, find the NTDS Settings object for each DC, and set msDS-MaximumPageSize to a higher value, like 5000. This is a forest-wide setting that also requires a domain functional level of 2008 R2 or higher. After changing it, wait for replication, then test your search again.

Alternative fixes if the main one fails

• If pagination doesn't work, you might have an outdated LDAP client that doesn't support it (rare with Windows 10/11, but possible with old tools). Upgrade to the latest version of whatever tool you're using.
• If narrowing the filter still errors, you have a corrupt NTDS database or a replication issue. Run dcdiag /test:replications on each DC to check for errors. If you see failures, fix replication first.
• As a last resort, use repadmin /syncall to force replication and clear stale references. Then retry your search.

How to prevent it from happening again

Set MaxPageSize to a reasonable ceiling across all DCs—5000 is safe for most environments. Always paginate in scripts and tools, even for small domains—it's a good habit. And when building LDAP queries, use specific filters: (objectCategory=person) instead of (objectClass=user) is faster and often returns fewer objects. For LDP and ADSI Edit users, make pagination your default—check that option once and forget it.