Fix ERROR_DS_OBJECT_RESULTS_TOO_LARGE (0X00002038)

Quick Answer

Add an index to the unindexed attribute causing the query, or reduce your LDAP filter scope to under 1000 results.

What's Happening Here

You're seeing ERROR_DS_OBJECT_RESULTS_TOO_LARGE (0x00002038) when an LDAP query hits Windows Server 2008 R2 through 2022. The culprit is almost always an unindexed attribute in the search filter. Active Directory has a hard limit of 1000 objects for unindexed searches (raised to 1500 in newer builds). When your query returns more than that, the domain controller throws this error instead of a partial result set.

This happens all the time with apps that do broad searches on attributes like memberOf, description, or custom extension attributes. I've seen it with backup tools, identity management software, and even the AD Recycle Bin tool when it tries to enumerate all deleted objects.

Step-by-Step Fix

Step 1: Identify the Offending Attribute

Turn on LDAP logging on the domain controller. Run this as admin:

wevtutil set-log "Directory Service" /enabled:true /level:5

Reproduce the error, then check Event Viewer under Applications and Services Logs > Directory Service. Look for event ID 2889 — it'll tell you exactly which attribute triggered the size limit. Example:

"The size limit was exceeded while searching for attribute 'memberOf' on object..."

Step 2: Add an Index to the Attribute

Use ADSI Edit. Connect to the Schema partition, find the attribute (like memberOf), right-click > Properties. Set searchFlags to 1. That means yes, index this attribute. Click OK. Wait 5 minutes for replication, then retry.

Alternatively, use PowerShell:

Set-ADObject -Identity "CN=memberOf,CN=Schema,CN=Configuration,DC=domain,DC=com" -Replace @{searchFlags=1}

Step 3: Test the Fix

Run your LDAP query again. If it works, you're done. If not, increase the administrative limit on the client side:

// In your LDAP code, set the size limit to 0 (unlimited)
// In ADUC or LDP, you can increase the page size to 10000

Alternative Fixes (If Indexing Doesn't Help)

• Narrow the search scope — Use a more specific base DN (e.g., OU=Users,DC=domain,DC=com instead of DC=domain,DC=com).
• Use paging — Most LDAP libraries support paged searches. Set page size to 500 or 1000. This respects the server limit but returns data in chunks.
• Increase MaxResults — On the DC, you can raise the MaxResults limit via group policy (Computer Configuration > Administrative Templates > System > Directory Service > LDAP server query limits). Setting it to 5000 is safe for most environments.
• Check for circular group membership — If the query involves memberOf and you have 500+ groups with nested memberships, you might hit the limit even with indexing. Flatten the group nesting.

Prevention Tips

• Index all attributes you search on — If your app or script does (objectClass=user) with cn=john*, make sure cn is indexed. It already is by default, but custom attributes aren't.
• Monitor AD with LDP or ADExplorer — Run occasional queries against unindexed attributes to catch problems before they hit production.
• Set realistic page sizes — Paging isn't a silver bullet, but it stops the error from blocking your app entirely. Always implement paging in LDAP code.
• Document your schema changes — When you add a new attribute, index it from the start. You can do this in the Attribute Editor when creating the attribute in AD Schema snap-in.