10976 » When you use the Dsrevoke tool in a Windows Server 2003 domain it does not return all the ACEs on all the OUs? (07-Nov-06)

This behavior will occur if the number of OUs in the domain is greater than the MaxPageSize setting.

NOTE: MaxPageSize is the number of responses to an LDAP query and defaults to 1000.

Since OUs are arranged according to their creation dates, the OUs added last are missing or have missing ACEs.

NOTE: If there are no ACEs specified in the first MaxPageSize OUs, you receive:

No ACEs for <domain\principalname>

NOTE: If an Organizational Unit contains the / character, it is not reported and you receive:

Error occurred in finding ACEs

End of Article