findDelegation.py 和 GetNPUsers.py 会默默地截断结果到 999 (缺少分页搜索)

Why 999 and not 1000: Active Directory's default MaxPageSize policy is 1000. The client-requested sizeLimit=999 falls below that, so AD honors 999 and returns sizeLimitExceeded when more results exist. Omitting sizeLimit (default 0 = unlimited) lets AD enforce its own 1000-entry limit server-side. Either way, the server drops results above the limit unless the client uses paged search controls.