如何使用T-SQL查询获取Active Directory中的1000条记录限制？

Question

下面的代码完美*如果我将光标限制为几个组,但如果我让它在我的整个域上运行,我在AD中遇到1000个记录限制.关于如何获得此分页的任何想法？

*完美是因为它应该只返回数量低于1000记录限制的有限数量的记录.

CREATE TABLE #MemberOfGroups
(
    groupName   VARCHAR (400),
    cn          VARCHAR (400),
    displayName VARCHAR (400)
);

SET NOCOUNT ON;

DECLARE @t AS VARCHAR (100), 
@t2 AS VARCHAR (1000), 
@ot AS VARCHAR (4000), 
@tt AS VARCHAR (4000);

DECLARE gC CURSOR
    FOR SELECT cn,
               distinguishedName
        FROM   OPENQUERY (ADSI, 'SELECT cn, distinguishedName
     FROM ''LDAP://DC=coal,DC=local''
     WHERE objectCategory = ''group''');

OPEN gC;

FETCH NEXT FROM gC INTO @t, @t2;

WHILE @@FETCH_STATUS = 0
    BEGIN
        SET @ot = '''SELECT cn, displayName
     FROM ''''LDAP://DC=coal,DC=local''''
     WHERE objectCategory = ''''Person'''' AND objectClass = ''''user''''
     AND memberOf=''''' + @t2 + '''''';
        SET @tt = 'select ' + '''' + @t + '''' + ' As GroupName, cn, displayName from openquery(ADSI,' + @ot + ''') order by cn';
        INSERT INTO #MemberOfGroups (groupName, cn, displayName)
        EXECUTE (@tt);
        --print @tt
        FETCH NEXT FROM gC INTO @t, @t2;
    END

CLOSE gC;

DEALLOCATE gC;  

Answer 1

查询到Active Directory的SQL Server ADO 非常有限,并且不提供完整的AD接口的所有功能.

根据Active Directory MVP Richard Mueller在他的网站上,在SQL Server AD搜索中无法规避或修复从搜索返回的1000-1500个对象的限制:

您应该注意两个限制.首先,OPENQUERY语句不支持多值属性.您无法检索多值属性的值,例如memberOf.其次,可以检索的记录总数限制为1500(Windows 2000 Active Directory中为1000).SQL分布式查询不支持分页,因此除了通过修改maxPageSize的Active Directory服务器限制之外,无法克服此限制.

所以我担心你无法直接从SQL Server这样做 - 你必须找到另一种方法来实现这一点.