AD query is unexpectedly slow
Documentation: Microsoft Learn
Work the problem
A report takes four minutes
Fictional case: The report fetches every user with every property, then filters for one OU and selects Name and Department. The same report previously ran against a smaller directory.
Reasoning notebook
Record the evidence that supports your answer and the check you would run next. Your notes stay in this browser — nothing is uploaded.
Why it happens
Retrieving all users and all attributes can dominate a report that needs only a small subset. A specific server-side filter is different from fetching everything with -Filter * and filtering locally. DC load, WAN latency and the chosen search base can also affect timing. Compare the intended result set while changing one factor at a time.
Check this first
What to look for
This reduces the objects and attributes retrieved. Compare timing and the intended result set using the same DC and scope.
Working through it
- Measure the current cost with Measure-Command so any improvement can be compared against a number.
- Move the condition out of Where-Object and into -Filter or -LDAPFilter so the controller does the selection.
- Name only the attributes the report consumes in -Properties and remove the wildcard.
- Add -SearchBase to confine the query to the relevant OU subtree.
- Point -Server at a nearby domain controller instead of letting the locator pick one across a WAN link.
Avoiding it next time
Verify the repair: Confirm the optimized query returns the same intended accounts and attributes; compare timings across repeated runs on the same DC.