title: DirectorySearcher does not return all AD group members
body: <p>I try to get all members of an Active Directory group in C#. My code looks like:</p>
  
  <pre><code>var searcher = new DirectorySearcher(defaultNamingContextEntry) {
      Filter = "(memberOf=" + group.Properties["distinguishedName"].Value + ")",
      PageSize = 1000,
      SearchScope = SearchScope.Subtree,
      Sort = new SortOption("sAMAccountName", SortDirection.Ascending)
  };
  var members = searcher.FindAll();
  </code></pre>
  
  <p>The code works so far, but has the problem that it does not return <em>all</em> group members.</p>
  
  <p>I believe (I am not sure) that it returns what I can actually see for the "member" attribute in ADSI Edit (the group in question is a bit large to compare everything, but far below 1000), but these are not all members. There are users that are, according to AD Users &amp; Computers, in the group which are not listed. If I look in the "Member Of" page, I can see the group, and ACL settings via the group affect the missing users, too. However, they are not in the result set.</p>
  
  <p>The group in question is the primary group, in case this is relevant.</p>
  
  <p>What is wrong here? What would be the correct parameters or query? Is this a problem of the AD itself?</p>
  
  <p><strong>Update:</strong> I have further investigated the problem (and tested Brian's solution, which I strongly recommend if your property collections are really large; I thought that there must be some kind of paging mechanism for properties, but could not find how it works):</p>
  
  <p>I now know that the <code>DirectorySearcher</code> returns the <em>correct result as seen in ADSI edit</em>.</p>
  
  <p>I also know that the "Primary Group" (set by the "Set Primary Group" button on the "Member Of" page in AD Users &amp; Computers) is missing. Unix extensions are enabled in the AD, so we usually use this option. Changing the primary group changes which members are missing. The effect is deterministic.</p>
  
  <p>I have looked into the entries using ADSI edit, but could not find the field that would allow me to add the primary group in my search. Although I have enabled everything (Mandatory, Optional, Constructed, Backlink and System-only attributes), I cannot see the primary group.</p>
  
  <p>My revised question is: what is the correct LDAP filter for retrieving the primary group, too?</p>