specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Microsoft Windows Server
providerId: microsoft-windows-server
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Rate Limiting
  - Server
  - Operating System
  - Windows
  - Microsoft
description: Windows Server platform APIs (PowerShell remoting, WinRM, WMI, IIS, ADWS) are typically
  consumed within the customer's own fabric over Kerberos / NTLM and are not subject to a Microsoft-imposed
  per-second rate limit. Throughput is bound by the customer's hardware, IIS request queue, WinRM
  MaxConcurrentOperations, and Active Directory throttling. There is no public throttling SLA for the
  OS itself.
sources:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrm
  - https://learn.microsoft.com/en-us/windows/win32/winrm/portal
notes: Windows Server is customer-operated; rate limits are configured locally rather than published
  by Microsoft as service-level numbers.
responseCodes: {}
limits:
  - name: WinRM concurrent operations (default)
    scope: account
    metric: concurrent_requests
    limit: 1500
    notes: Default MaxConcurrentOperationsPerUser per WinRM listener; tunable via Set-WSManInstance.
  - name: WinRM connections per user (default)
    scope: account
    metric: concurrent_requests
    limit: 25
    notes: Default MaxConcurrentUsers; configurable.
  - name: IIS HTTP request queue
    scope: account
    metric: varies
    limit: 'Set per application pool via queueLength (default 1000); responses can be 503 when full'
  - name: Active Directory LDAP MaxPageSize
    scope: account
    metric: varies
    limit: '1,000 entries per page (default); MaxPageSize / MaxQueryDuration tunable on the DC'
policies:
  - name: Tune WinRM service quotas
    description: WSMan provider settings (MaxConcurrentOperationsPerUser, MaxConnections,
      MaxConcurrentUsers) cap parallel remoting; tune per workload.
  - name: AD policy throttling
    description: Active Directory enforces LdapAdminLimits (MaxPageSize, MaxQueryDuration,
      MaxConnIdleTime). Honor these in client query patterns.
  - name: 503 from IIS
    description: IIS returns 503 when application pool queues are full; clients should backoff and
      retry.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com