New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve performance and politeness of Get-ADSIGroupMember and Get-WinNTGroupMember #42

Open

IMJLA opened this issue Sep 3, 2022 · 1 comment

Labels

enhancement enhancement-performance

Owner

IMJLA commented Sep 3, 2022 •

edited

Loading

Copied from Issue #3

Plan for future improvement:

For each group:
- return LDAP filter segment for samaccountname (if done by Get-WinNTGroupMember)
- return LDAP filter segment for memberOf and primaryGroupID (if done by Get-AdsiGroupMember)
Single LDAP search for all members of all groups
Enumerate member groups from those results in memory
Single LDAP search for objects with any of those groups as primary group

IMJLA added the enhancement label

Owner Author

IMJLA commented Sep 3, 2022

This could be applied more broadly to the entire script

For each IdentityReference:
- If NTAccount caption, return as-is (domain\name or domain\sid if it is an unresolved sid)
- If SID, resolve to NTAccount caption and return that
Single LDAP search per domain for all NTAccount captions and their members
Enumerate member groups from those results in memory
Group those groups by domain
Single LDAP search per domain for objects with any of these groups for that domain as primary group

IMJLA added the enhancement-performance label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment