How to we increase Common-Name attribute maximum length

active-directorywindows-server-2008-r2

Context: We have a MS Exchange Add-on to implement email address substitutions of Distribution Lists. It's called Code2. It uses Active Directory group common names (CN) and this has a max limit of 64 characters.

Questions:

  1. Would it be possible to increase this limit?
  2. If yes, is there a patch for this?

Best Answer

No you cannot* change the CN limit to be larger than 64. References include MSDN, MSDN again, and a Microsoft group thread.

(*Okay, yes you can hack around LDAP in ADSI edit and find the CN attribute and increase it. This will do Evil Things as CNs are expected to be a certain length limit that will fit in the overall 256 character display name limit and also break certificates if you ever have a PKI because certificates are expected to never have CN attribute longer than 64 characters as per RFC 5280)