Group membership search breaks with Active Directory's automatic range limiting for large groups

For performance reasons, Active Directory puts an automatic limit on LDAP queries: either 1000 results (on Windows 2000) or 1500 results (on Windows Server 2003). The correct way to retrieve results past this limit is to use the range option, as described here:

http://msdn.microsoft.com/library/en-us/ldap/ldap/searching_using_range_retrieval.asp

Unless we support this option, group search is broken for groups with more than this limited number of users.