DirectorySearcher does not return all AD group members

Question

I try to get all members of an Active Directory group in C#. My code looks like:

var searcher = new DirectorySearcher(defaultNamingContextEntry) {
    Filter = "(memberOf=" + group.Properties["distinguishedName"].Value + ")",
    PageSize = 1000,
    SearchScope = SearchScope.Subtree,
    Sort = new SortOption("sAMAccountName", SortDirection.Ascending)
};
var members = searcher.FindAll();

The code works so far, but has the problem that it does not return all group members.

I believe (I am not sure) that it returns what I can actually see for the "member" attribute in ADSI Edit (the group in question is a bit large to compare everything, but far below 1000), but these are not all members. There are users that are, according to AD Users & Computers, in the group which are not listed. If I look in the "Member Of" page, I can see the group, and ACL settings via the group affect the missing users, too. However, they are not in the result set.

The group in question is the primary group, in case this is relevant.

What is wrong here? What would be the correct parameters or query? Is this a problem of the AD itself?

Update: I have further investigated the problem (and tested Brian's solution, which I strongly recommend if your property collections are really large; I thought that there must be some kind of paging mechanism for properties, but could not find how it works):

I now know that the DirectorySearcher returns the correct result as seen in ADSI edit .

I also know that the "Primary Group" (set by the "Set Primary Group" button on the "Member Of" page in AD Users & Computers) is missing. Unix extensions are enabled in the AD, so we usually use this option. Changing the primary group changes which members are missing. The effect is deterministic.

I have looked into the entries using ADSI edit, but could not find the field that would allow me to add the primary group in my search. Although I have enabled everything (Mandatory, Optional, Constructed, Backlink and System-only attributes), I cannot see the primary group.

My revised question is: what is the correct LDAP filter for retrieving the primary group, too?

Answer 1

You need to do value ranging. See http://www.netid.washington.edu/documentation/enumeratingLargeGroups.aspx for an example.