Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article discusses how to troubleshoot the "Size Limit Exceeded - Error Code 0x4" error message that occurs during the delta import step from an on-premises Active Directory in Microsoft Entra Connect.
Symptoms
In the Synchronization Service Manager app, the Delta Import steps from the on-premises Active Directory connector fail. The Connection Log dialog box displays a dropped-connection status, a Size Limit Exceeded error, and an error code of 0x4:
In the Application log, the error event ID 6050 is recorded, as shown in the following example:
Log Name: Application
Source: ADSync
Date: 5/12/2023 7:34:38 AM
Event ID: 6050
Task Category: Management Agent Run Profile
Level: Error
Keywords: Classic
User: N/A
Computer: AADConnect.Contoso.com
Description:
The management agent "Contoso.com" failed on run profile "Delta Import" because of connectivity issues.
Additional Information
Discovery Errors : "0"
Synchronization Errors : "0"
Metaverse Retry Errors : "0"
Export Errors : "0"
Warnings : "0"
User Action
View the management agent run history for details.
Cause
By default, when you make a Lightweight Directory Access Protocol (LDAP) search or query in Microsoft Entra ID, the directory can return no more than 1,000 records. By security design, this is the default behavior of Active Directory. The 1,000-record limit is intended to prevent a distributed denial-of-service (DDoS) attack on LDAP queries. This issue can occur if you recently restored a large number of objects simultaneously from the Active Directory Recycle Bin. The restore process can cause the delta import query to exceed the record limit.
Solution 1: Run a full import on the AD DS connector
The easiest resolution to this issue is to manually run a full import (instead of a delta import) on the Active Directory Domain Services (AD DS) connector. Follow these steps:
Select Start, and then search for and select Synchronization Service Manager.
In the Synchronization Service Manager window, select the Delta Import step of the on-premises AD Connector that isn't connecting. Look for the Delta Import step that shows a stopped-connectivity status.
Select Ctrl+F5, or right-click your selection, and then select Run.
In the Run Connector dialog box, select the Full Import run profile, and then select OK.
After the full import finishes, open a PowerShell console, and run the Start-ADSyncSyncCycle
cmdlet to start a normal delta synchronization cycle. This process is described in Microsoft Entra Connect Sync: Scheduler.
Solution 2: Temporarily increase the record limit
If you don't want to run a full import on the AD DS connector, you can temporarily change your configuration so that an LDAP search can return a larger number of records during delta synchronization.
To increase the 1,000-record limit, increase the maximum page size (MaxPageSize
) setting to accommodate the number of objects that the delta import step returns. For example, if you restored an Organization Unit (OU) that has 5,000 users, we recommend that you temporarily increase MaxPageSize
to a value of 5,000. Then, after the Microsoft Entra Connect issue is resolved, restore MaxPageSize
to the default value of 1,000.
To change the MaxPageSize
setting, run the Ntdsutil command, as shown in the following procedure. For more information about MaxPageSize
, see LDAP administration limits.
Important
Follow the steps in this section carefully. Serious problems might occur if you modify the default AD configuration incorrectly. When the issue is resolved, you can restore the default values.
Select Start, enter Command Prompt, and then select Run as administrator.
At the command prompt, enter
ntdsutil
to start an Ntdsutil console session.In the View and set LDAP policy in Active Directory by using Ntdsutil.exe article, follow the instructions in the View current policy settings section to learn what the policy settings currently are.
To change the maximum page size, enter
set MaxPageSize to <new-maximum-page-size-value>
.Enter
commit changes
to apply the new value.To exit the Ntdsutil session, enter
quit
two times.
After you make the configuration change, open a PowerShell console, and then run the Start-ADSyncSyncCycle
cmdlet to start a normal delta synchronization cycle. This process is described in Microsoft Entra Connect Sync: Scheduler. Now, Active Directory returns a larger number of records, and it should be able to provide the full delta response to Microsoft Entra Connect.
After the delta synchronization finishes successfully, repeat the procedure to restore the MaxPageSize
setting to its original value (1,000).
References
Contact us for help
If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.