Wanted to share something important with the people reading this and getting it into the Google cache.
We had a customer with huge numbers of DirXMl-EntitlementResult values on users.
By huge I mean 800 with more > 1000 values. Some had over 10,000 values. It was pretty terrible.
This was actually causing eDir sync issues and we were getting strange 625 and 626 errors.
Support was succesful in nailing it down to these crazy # of values as the replication issue.
Really good news is that from the forums here has an awesome tool Console2, that has a Multiple Value Report subtool, that allows you to find all users with more than N number of values.
I tried checking for more than 25, and this customer had 22,000 users! Over 1000 found almost 800! Crazy crap. One user had 16,000 values, and each one was 18K in size, which is madness. You can imagine how hard replicating that might be.
Console2 generates an LDIF as the output to clean up as well. (That guy thinks of everything!).
The real fix has been in the User App driver since 4.0x (2.2.0 package at least) and is a GCV called
This default to Current which seems to do nothing. Switch it to either previous (keeps this and the one just before it) or notnewer which keeps any future timestamped ones and nothing earlier.
Then each time a user passes through the UA for this attribute it will clean up.
Use Alekz's tool to clean up the terrible users, and let the system clean up over time the rest. If you do not yet use Console2, then you are just not doing IDM correct. This is the single most useful IDM tool I have found. well done indeed Alekz.
Go to http://sneakycat.biz to download a copy and get a license.