Number of users per container (OU) in ADAM / AD

8 Feb 2006 11:37 PM

Craig Gilmour

All,
I a planning on using ADAM as a staging point for some synchronisation
process and wanted to keep a flat direcory tree structure (i.e. a single OU)
to store users in for this process. Are there any theoritical and realistic
limits to the number of users I should add to a single ADAM containers? I am
planning on using ADAM SP1, though I may have to go back to the original
version if testing shows any issues. I have also been asked the question
around limitations in AD (WIN2K and Windows 2003), though ADAM is my priority.

Is there any documentation / experience for the following directory
platforms for number of users per container?

ADAM
ADAM SP1
AD 2003
AD 2000

regards,
Craig Gilmour

9 Feb 2006 3:08 AM

Joe Kaplan (MVP - ADSI)

It doesn't matter how many objects are in a single container. The only
limits you need to worry about are the max number of objects or security
principals that ADAM will support. This number is quite large (millions),
but I'm not sure exactly what the theoretical maximums are when the objects
are security principals.

Joe K.

Show quoteHide quote

"Craig Gilmour" <CraigGilm***@discussions.microsoft.com> wrote in message
news:FC4453C8-35EE-4FBA-B76C-6744C816D835@microsoft.com...
> All,
> I a planning on using ADAM as a staging point for some synchronisation
> process and wanted to keep a flat direcory tree structure (i.e. a single
> OU)
> to store users in for this process. Are there any theoritical and
> realistic
> limits to the number of users I should add to a single ADAM containers? I
> am
> planning on using ADAM SP1, though I may have to go back to the original
> version if testing shows any issues. I have also been asked the question
> around limitations in AD (WIN2K and Windows 2003), though ADAM is my
> priority.
>
> Is there any documentation / experience for the following directory
> platforms for number of users per container?
>
> ADAM
> ADAM SP1
> AD 2003
> AD 2000
>
> regards,
> Craig Gilmour

9 Feb 2006 5:41 AM

Ace Fekay [MVP]

In news:%23MtGmYSLGHA.1536@TK2MSFTNGP11.phx.gbl,

Joe Kaplan (MVP - ADSI) <joseph.e.kap***@removethis.accenture.com> stated,
which I commented on below:

> It doesn't matter how many objects are in a single container. The
> only limits you need to worry about are the max number of objects or
> security principals that ADAM will support. This number is quite
> large (millions), but I'm not sure exactly what the theoretical
> maximums are when the objects are security principals.

Joe I believe it's 4.3 billion objects, whether security principals or
other. It's based on the 32bit addressable limit, which limits the
references that a GC can handle and replicate between themselves. You can
theoretically create more than that (users and other objects) in any given
domain, but the GC won't accept it therefore the objects won't be searchable
or usable, such as to login.

Theoretically...

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.

Not sure how? It's easy:
How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Windows Server Directory Services
Microsoft Certified Trainer
Assimilation Imminent. Resistance is Futile.
Infinite Diversities in Infinite Combinations.

The only thing in life is change. Anything less is a blackhole consuming
unnecessary energy.
===========================

12 Feb 2006 11:49 PM

Dmitri Gavrilov [MSFT]

AD and ADAM use 32-bit internal IDs, and they should not wrap. Some
speculate that it is treated as signed in some parts of the code, so it's
more like 2.2 billion. And, some say, only 1 billion. That said, it is
theoretical limit. To the best of my knowledge, nobody tried it this big
yet. Eric was experimenting with some 50M ADAM recently, but it takes a
while even to create a dit this big.

--
Dmitri Gavrilov
SDE, DS Admin eXperience

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"Ace Fekay [MVP]"
<PleaseSubstituteMyActualFirstName&LastNameH***@hotmail.com> wrote in

Show quoteHide quote

message news:uOFdxtTLGHA.744@TK2MSFTNGP09.phx.gbl...
> In news:%23MtGmYSLGHA.1536@TK2MSFTNGP11.phx.gbl,
> Joe Kaplan (MVP - ADSI) <joseph.e.kap***@removethis.accenture.com> stated,
> which I commented on below:
>> It doesn't matter how many objects are in a single container. The
>> only limits you need to worry about are the max number of objects or
>> security principals that ADAM will support. This number is quite
>> large (millions), but I'm not sure exactly what the theoretical
>> maximums are when the objects are security principals.
>
> Joe I believe it's 4.3 billion objects, whether security principals or
> other. It's based on the 32bit addressable limit, which limits the
> references that a GC can handle and replicate between themselves. You can
> theoretically create more than that (users and other objects) in any given
> domain, but the GC won't accept it therefore the objects won't be
> searchable or usable, such as to login.
>
> Theoretically...
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Having difficulty reading or finding responses to your post?
> Instead of the website you're using, I suggest to use OEx (Outlook Express
> or any other newsreader), and configure a news account, pointing to
> news.microsoft.com. This is a direct link to the Microsoft Public
> Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows
> you to easily find, track threads, cross-post, sort by date, poster's
> name, watched threads or subject.
>
> Not sure how? It's easy:
> How to Configure OEx for Internet News
> http://support.microsoft.com/?id=171164
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft MVP - Windows Server Directory Services
> Microsoft Certified Trainer
> Assimilation Imminent. Resistance is Futile.
> Infinite Diversities in Infinite Combinations.
>
> The only thing in life is change. Anything less is a blackhole consuming
> unnecessary energy.
> ===========================
>

13 Feb 2006 5:52 AM

Ace Fekay [MVP]

In news:OySjq7CMGHA.3272@tk2msftngp13.phx.gbl,

Dmitri Gavrilov [MSFT] <dmit***@online.microsoft.com> stated, which I
commented on below:

> AD and ADAM use 32-bit internal IDs, and they should not wrap. Some
> speculate that it is treated as signed in some parts of the code, so
> it's more like 2.2 billion. And, some say, only 1 billion. That said,
> it is theoretical limit. To the best of my knowledge, nobody tried it
> this big yet. Eric was experimenting with some 50M ADAM recently, but
> it takes a while even to create a dit this big.

Hmm, didn't think about the signing part, so that would reduce the overall
limit. And a 50 million is a big one to get populated!

Thanks Dmitri for the info. Extremely informative. This is good info I can
use as a "theoretical" possibility for AD for my students when I teach the
AD courses.

Ace