Variable property slow access on first hit

Question

Variable property slow access on first hit

Alexandru Margoi 0

Hello,

I hope someone could help me out with some information as I feel like I am losing my mind. I have spent 4 hours troubleshooting a slow 20.000 objects output, only to come down to this and I don't understand what is happening.

I am fetching 20.000 AD Group objects from AD into a variable. I need the extensionAttribute15 and their DistinguishedName properties only. Exporting them takes an unknown amount of time, when it should in fact take less than a minute maybe. What I have found so far, is that when accessing the extensionAttribute15 property the first time, it takes 350ms. While accessing it a 2nd time takes almost 0 ms.
Here is a sample code:

$controlGroups = Get-ADGroup `
    -Filter "extensionAttribute15 -like '*remove*'" `
    -Server $server `
    -Properties extensionAttribute15

for ($i = 100; $i -lt 120; $i++) {
    $sw = [Diagnostics.Stopwatch]::StartNew()

    $null = $controlGroups[$i].extensionAttribute15

    $sw.Stop()
    
    Write-Host "$i : $($sw.Elapsed.TotalMilliseconds) ms"
}

Now, running this is showing me 350ms for these 21 objects. Running the FOR loop once again, shows me

0.05 ms per property access. If I replace extensionAttribute15 with DistinguishedName, I get consistent 0.03 ms.

What is different on extensionAttribute15? These attributes are both reported as String by GetType().

0 comments

1 answer

Your answer

Answer 1

Hello Alexandru,

What you are seeing is most likely a first-access materialization/caching effect in the Active Directory PowerShell object, not a new LDAP query for each object. DistinguishedName is a core/default property on the returned ADGroup object, while extensionAttribute15 is an additional LDAP attribute requested through -Properties, so it is exposed through the AD module’s property bag and can have a noticeable first-read cost before subsequent access becomes cached in the PowerShell session. The fact that the second loop drops to almost zero strongly suggests the data is already present locally and the delay is caused by object/property resolution rather than the domain controller.

For export, I would avoid repeatedly touching the raw AD object properties and instead materialize the values once into plain PowerShell objects before exporting, for example:

Get-ADGroup -Filter "extensionAttribute15 -like 'remove'" -Server $server -Properties extensionAttribute15 |

Select-Object DistinguishedName, @{Name='extensionAttribute15';Expression={[string]$_.extensionAttribute15}} |

Export-Csv .\groups.csv -NoTypeInformation -Encoding UTF8

If this still takes an unexpectedly long time for 20,000 groups, the next useful comparison would be measuring the full Get-ADGroup query separately from the Export-Csv step, because the slow part may be the AD query, object materialization, console output, or CSV serialization rather than the property value itself.