Fix ERROR_DS_ADMIN_LIMIT_EXCEEDED 0x00002024

30-Second Fix: Check Your LDAP Query

This error pops up when your LDAP query returns more objects than AD allows. The culprit here is almost always a search that's too broad. If you just ran something like dsquery * -filter "objectClass=user" against the entire domain, you'll hit this fast. Stop the query and narrow it down with a base DN or a more specific filter.

dsquery * -filter "(&(objectClass=user)(department=IT))" -base "DC=contoso,DC=com"

If that fixes it, you're done. If not, move on.

5-Minute Fix: Adjust maxPageSize and maxValRange

The real fix is in AD's LDAP policy. Two settings control this: maxPageSize (default 1000) and maxValRange (default 0, meaning unlimited). When you're querying more than 1000 objects, you need to either paginate or increase the limit.

Open Active Directory Administrative Center on a DC. Navigate to your domain, then View → Node → Domain → LDAP. Or use the command line — it's faster:

ntdsutil
LDAP policies
Connections
Connect to server DC01.contoso.com
Quit
Show values

Look at MaxPageSize. If it's 1000 and you need more, set it higher. Don't go crazy — 2000-5000 is usually safe for most environments. I've seen people set it to 10000 and regret it when a misconfigured app hammers the DC.

Set MaxPageSize to 5000
Commit changes
Quit
Quit

If you're still getting the error after that, check MaxValRange. Some apps hit this when they query multi-valued attributes (like memberOf) on a single object with thousands of values.

Set MaxValRange to 1500
Commit changes

Restart the Active Directory Domain Services service or reboot the DC for changes to take effect.

15-Minute Fix: Audit Your Applications and Set Permanent Policies

If the error keeps coming back, you've got an application or script that's hitting the limit repeatedly. Find it. Check the event logs on your DCs — look for Event ID 1644 under Directory Service. It logs LDAP queries that exceed thresholds, including the client IP and the filter used.

Get-WinEvent -LogName "Directory Service" | Where-Object { $_.Id -eq 1644 } | Select-Object TimeCreated, Message -First 10

Once you know the source, fix the query. Most third-party apps that poll AD (monitoring tools, identity management systems) have configurable page sizes. Set them to 500 or 1000 and enable pagination.

For a permanent AD-side fix, set the LDAP policy via a script so it survives reboots:

ntdsutil
LDAP policies
Connections
Connect to server DC01.contoso.com
Quit
Set MaxPageSize to 5000
Set MaxValRange to 1500
Commit changes
Quit
Quit

Also check MaxTempTableSize if you're on a large domain (50,000+ objects). Default is 10000 pages. Bump it to 20000 if queries against big groups or OUs crash.

Set MaxTempTableSize to 20000
Commit changes

For Server 2019 and 2022, these changes stick after reboot. On older versions like 2008 R2, you'd need a registry tweak — don't bother unless you're stuck on legacy hardware.

When to Call Microsoft Support

If you've upped MaxPageSize to 10000, MaxValRange to 5000, and the error still appears, you're dealing with something else. Could be a corrupt AD database (run ntdsutil and check integrity) or a third-party driver intercepting LDAP calls. I've only seen that twice in 14 years, so it's rare. But if you're there, open a case with Microsoft.

Pro tip: Don't set these values globally unless you know what you're doing. Test on one DC first. A runaway query from a misconfigured app can tank CPU on all your DCs if you remove the guardrails.