note snoopy You didn't say what LDAP class your objects are. <p> I'm guessing that they're of type <code>person</code> or <code>organizationalPerson</code> <p> In which case, <code>cn</code>, although it contains numeric data, is declared within LDAP as a text attribute. <p> So your upper bound, "1000" when treated as a string, is less than your lower bound, "500". 924269 924269