Get-QADuser Faster ?

i improve performance of 1 of script. i'm using quest cmdlets get-qaduser, , slowness comes command

measure-command { get-qaduser -searchattributes @{employeeid=102541} -enabled -dontusedefaultincludedproperties} 
measure-command { get-qaduser -ldapfilter '(employeeid=102541)' -enabled -dontusedefaultincludedproperties} 

the 2 commands above takes around 400/500 millisecond each. i've tried use -searchroot reduce scope, little, rather not use it, because want check entire ad.

i not necessarily want use get-qaduser.

any ideas ?

 

sorry, missed -enabled switch, although i assume means cmdlet won't return object unless account enabled. still, directorysearcher filter ldap standard used many tools, joe richards' adfind, dsquery *, etc. find enabled users employeeid equal 102541 filter be:

$searcher.filter = "(&(employeeid=$id)(!useraccountcontrol:1.2.840.113556.1.4.803:=2))"

 

the "&" "and" operator (both clauses must return true), , "!" "not" operator. second clause means "account disabled" bit (with bit mask 2) of useraccountcontrol flag attribute not set. ugly, works , standard.

to modify user object need bind it. believe faster method (if matters) is to use the [adsi] accelerator. code modify user object, given have distinguished name assigned $dn variable, similar to:

$user = [adsi]:"ldap://$dn"  # disable account. assumes account enabled.  $flag = $user.useraccountcontrol.value  $flag = $flag -bxor 2  $user.useraccountcontrol = $flag  # assign description.  $user.description = "account disabled"  # save changes ad.  $user.setinfo()

 

when measure "performance" of different techniques find if repeat immediately, second trial faster. cached , skews results. find need wait 10 15 minutes between trials consistent results. have code repeat a query several times 15 minute pause between trials. average results. example, i've used following:

function queryad($count, $arrnames)  {    $dtminitial = get-date    $domain = new-object system.directoryservices.directoryentry    $searcher = new-object system.directoryservices.directorysearcher    $searcher.searchroot = $domain    $searcher.pagesize = 200    $searcher.searchscope = "subtree"      $searcher.propertiestoload.add("distinguishedname") > $null      $dtmstart = get-date    foreach ($name in $arrnames) {      $searcher.filter = "(samaccountname=$name)"      $results = $searcher.findall()      foreach ($result in $results)      {        $dn = $result.properties.item("distinguishedname")      }    }      $dtmend = get-date    add-content -value "-- $count --" -path "c:\powershell\findusers.txt"    add-content -value $($dtmstart - $dtminitial) -path "c:\powershell\findusers.txt"    add-content -value $($dtmend - $dtmstart) -path "c:\powershell\findusers.txt"    add-content -value $($dtmend - $dtminitial) -path "c:\powershell\findusers.txt"  }    # specify array of "pre-windows 2000 logon" names.  $names = @("jsmith", "wrogers", "bfranklin", "jmonroe", "jmadison", `    "gwashington", "tjefferson", "fwilliamson", "wjohnson", "jkirk")    # repeat 4 times.  $j = 1  while ($j -le 4)  {    # query ad.    queryad $j $names    # pause 15 minutes.    start-sleep -seconds 900    $j = $j + 1  }  # query ad 5th time.  queryad $j $names

 

this takes on hour, that's computers for.

 

---

richard mueller - mvp directory services

Windows Server  >  Windows PowerShell