How would you troubleshoot slow AD queries?
Documentation: Microsoft Learn
Diagnose slow AD queries by measuring scope, server-side filters, returned properties, connectivity and repeated lookups.
Interview · Question 25 of 34
Answer before reveal
Your draft
Write the answer you would give in an interview. The model answer stays hidden until you have drafted at least a short response.
A strong answer
First measure a small, repeatable query and separate directory lookup time from the processing that follows it. Record which domain controller is queried, the search scope and the properties requested. A slow result does not automatically mean that the directory server is slow; repeated queries inside a loop and client-side processing can dominate the total runtime.
Narrow the search with an appropriate SearchBase and use the command's supported server-side filter when possible. Request only the extra properties that the task needs. Fetching a broad result with every property and filtering it later transfers and processes data that may never be used. Validate that a narrower query still returns the intended accounts before treating it as an improvement.
Check DNS, connectivity and the chosen domain controller when response times vary unexpectedly. If a script repeatedly resolves the same identity, consider reusing the result within that run. Compare timings with the same workload, and include result counts so a query that accidentally returns less data is not mistaken for a correct optimization.
Show it concretely
Expect this follow-up
Which AD query measurements would you capture before and after changing the filter or properties?
