慢 Get-ADUser 查询

Question

Something I do not unterstand. See the following two code examples.

  $LDAPResult1 = Get-ADUser -LDAPFilter "(&(objectCategory=user)(sAMAccountName=*))" -Properties @("distinguishedName","sAMAccountName","extensionAttribute13") -SearchBase "ou=test,dc=test,dc=ch"
  $LDAPElements1=@{}
  $LDAPResult1 |% {$LDAPElements1.Add($_.SAMAccountName, $_.extensionattribute13)}

compared with (adding a specific server to ask "-Server 'dc.test.test.ch'"):

  $LDAPResult1 = Get-ADUser -LDAPFilter "(&(objectCategory=user)(sAMAccountName=*))" -Properties @("distinguishedName","sAMAccountName","extensionAttribute13") -SearchBase "ou=test,dc=test,dc=ch" -Server 'dc.test.test.ch'
  $LDAPElements1=@{}
  $LDAPResult1 |% {$LDAPElements1.Add($_.SAMAccountName, $_.extensionattribute13)}

The first code takes 30 seconds, the second about 5 minutes. The problem ist not the AD query. This takes around 30 seconds in both cases. But filling the result into the hash table is what is differnet. It seems as if in the second case while filling the hash sill some data is requested from the DC.

What is also interesting. When I wait for five minutes after doing the AD query in case two and then execute the filling into the hash table, then the command takes a second.

I rather would likt to define to what server the command connects in order to execute the folloing commands on the same DC, but this does not make sense if it takes that long.

Can anyone enlighten me …

Addition: We are Talking about 26'000 accounts.

Answer 1

I was able to replicate this. The behaviour does change when you specify the -Server parameter vs. when you don't.

I usedProcess Monitor to watch network activity and it definitely is talking to the DC when looping through the results returned from using the -Server parameter.

I can't explain why, but it seems like the ADUser objects returned are not populated with the properties from the search. So when they are accessed, it loads the properties from the DC. I could see this when accessing one particular element in the array:

$LDAPResults1[1000]

It displayed the properties, but I also saw network activity in Process Monitor. Whereas I do not see network activity when accessing one element from the results returned when not using the -Server parameter.

So that kind of explains what is happening, but not why . And I really don't know why.

However, I have learned that if you want performance when talking to AD, you have to scrap all the "easy" ways and do things yourself. For example, use the .NET DirectoryEntry and DirectorySearcher classes directly, which can be done in PowerShell using the "type accelerators" [adsi] and [adsisearcher] . For example, this will do the same and will perform consistently:

$dc = "dc.test.test.ch"
$searchBase = "ou=test,dc=test,dc=ch"
$searcher = [adsisearcher]::new([adsi]"LDAP://$dc/$searchBase", "(objectCategory=user)")

$searcher.PropertiesToLoad.Add("sAMAccountName") > $null
$searcher.PropertiesToLoad.Add("extensionAttribute13") > $null

$searcher.PageSize = 1000

$LDAPElements1=@{}
foreach ($result in $searcher.FindAll()) {
    $LDAPElements1.Add($result.Properties["sAMAccountName"][0], $result.Properties["extensionAttribute13"][0])
}

Answer 2

Export Get-ADUser results into a temporary CSV file and import it back to some objects.

Get-ADUser -LDAPFilter (....) | Export-Csv -Path "TempCSV.csv" -Encoding UTF8 -Delimiter ","
$ADUsers = Import-Csv -Path "TempCSV.csv" -Encoding UTF8 -Delimiter ","

Now you can loop the users object.

foreach ($ADUser in $ADUsers) { (....) }

Answer 3

I found the following code to be extremely slow.

$user = Get-ADUser -LDAPFilter $filter  -Server "xyc" -Properties "sAMAccountName"

I was able to rewrite it as:

$directorySearcher = New-Object System.DirectoryServices.DirectorySearcher
$directorySearcher.SearchRoot = [ADSI]'LDAP://xyz'
[void]$directorySearcher.PropertiesToLoad.Add('cn')
[void]$directorySearcher.PropertiesToLoad.Add('sAMAccountName')
$directorySearcher.Filter = "(cn=abcd efg)"
$results = $directorySearcher.FindOne()
Write-Host $results.Properties["samaccountname"] -as [String]

and it was a lot faster (by an order of magnitude) than using GetAd-User (but still slow).