问题:

Can anyone point me to a resource that defines the maximum allowable length of the LDAP filter string in Active Directory?

回答1:

According to Technet: How Active Directory Searches Work, the maximum LDAP request size that the server attempts to process defaults to 10,485,760 bytes.

If the server receives a request that is larger than this value, it closes the connection. Hope that helps.

回答2:

If you're using the AD Users and Groups GUI interface to contruct the query you are limited to 464 characters. If you're using dsquery from the command line you are not limited to 464 characters. I don't know the upper bounds for filter length on dsquery, but I assume it's inline with the LDAP spec.

回答3:

According to the specification in RFC1558, there is not a hard limit imposed on the length of LDAP filter strings. Different implementations might have their own limits though.