AdguardSvc.exe polls WMI Win32_UserAccount every ~11 s, generating continuous SMB/LSA traffic to the domain controller on domain-joined machines

### Please answer the following questions for yourself before submitting an issue

- [x] Filters were updated before reproducing an issue
- [x] I checked the [knowledge base](https://adguard.com/kb/) and found no answer
- [x] I checked to make sure that this issue has not already been filed

### AdGuard version

8.0.0 (5560)

### Browser version

Chrome 152 (not related — the issue occurs with no browser running)

### OS version

Windows 11 Pro, 25H2 (OS build 26200.9168), joined to an Active Directory domain

### Traffic filtering

- [ ] yes, I do

### Ad Blocking

_No response_

### Privacy

_No response_

### Social

_No response_

### Annoyances

_No response_

### Security

_No response_

### Other

_No response_

### Language-specific

_No response_

### Which DNS server do you use?

System default DNS

### DNS protocol

Regular

### Custom DNS

_No response_

### What Stealth Mode options do you have enabled?

_No response_

### Support ticket ID

1561487

### Issue Details

Environment note: this only happens on a machine that is **joined to an Active Directory domain**. It does not occur on a standalone / workgroup machine.

Steps to reproduce:

1. Install AdGuard for Windows on a machine joined to an Active Directory domain.
2. Leave the machine completely idle (no browsing, no user activity).
3. Watch the Ethernet throughput graph in Task Manager, or monitor the `\Redirector\Bytes Received/sec` performance counter.
4. Observe a burst of traffic to the domain controller on TCP/445 roughly every 11 seconds.

Root cause (already identified):

`AdguardSvc.exe` executes the WMI query `SELECT * FROM Win32_UserAccount` (namespace `root\CIMV2`) approximately **every 10.9 seconds**. On a domain-joined machine, enumerating this class enumerates **every user account in the entire AD domain**, so Windows issues a large number of LSA RPC calls (interface UUID `12345778-1234-abcd-ef00-0123456789ab`) to the domain controller over SMB (TCP/445).

Minimal reproduction of the cost of a single query:

```powershell
Get-CimInstance Win32_UserAccount
```

On my machine this returns 62 accounts and generates **274 KB of SMB receive traffic** — and AdGuard performs this every ~11 seconds, permanently.

### Expected Behavior

An idle machine with AdGuard installed should not generate continuous, periodic network traffic to the domain controller.

AdGuard should not enumerate all domain user accounts every ~11 seconds.

### Actual Behavior

Even when the machine is completely idle, AdGuard causes a burst of roughly **500 KB of network traffic (send + receive combined) to the domain controller every ~11 seconds, continuously**.

This is not a crash or a visible malfunction — it is a permanent background load that is invisible unless you happen to look at a network graph. I originally noticed it as regular spikes in Task Manager and traced it back to AdGuard.

It also places a corresponding permanent load on the domain controller itself, and the cost scales with the number of accounts in the domain.

### Screenshots

Task Manager — Ethernet throughput on an idle machine

### Additional Information

### Evidence

**a) The WMI query and its source process** — ETW provider `Microsoft-Windows-WMI-Activity`:

```
"select * from Win32_UserAccount", "//./root/CIMV2",
```

Recorded repeatedly at ~10.9 second intervals.

**b) The resulting RPC calls** — ETW provider `Microsoft-Windows-RPC`:
`WmiPrvSE.exe` making LSARPC calls (`{12345778-1234-abcd-ef00-0123456789ab}`) to `\\`.

**c) The network traffic** — `pktmon` capture filtered to TCP/445: confirmed as traffic between this machine and the domain controller.

**d) Service stop / start test** — measured with the `\Redirector\Bytes Received/sec` counter on an otherwise idle machine:

| State | Duration | SMB bytes received | Bursts observed |
|---|---|---|---|
| AdGuard running | 25 s | **1,254 KB** | 6 |
| AdGuard service stopped | 40 s | **1 KB** | **0** |
| AdGuard running again | 25 s | **1,095 KB** | 6 |

Stopping the AdGuard service eliminates the traffic completely; starting it reproduces the traffic immediately.

### Suggested fix

If only local account information is needed, please avoid enumerating `Win32_UserAccount` in full. Possible approaches:

- Restrict the query to local accounts (e.g. `WHERE Domain=''`), or use the `NetUserEnum` Win32 API with a local-only scope.
- Cache the result instead of re-querying every ~11 seconds.
- Substantially increase the polling interval.

On larger domains this polling will place a proportionally larger load on the domain controller, so the impact scales badly with domain size.

### Note

This was first reported to support (ticket regarding "AdGuard for Windows v8.0.0 (5560) – Bug"), and I was asked to post it here.