Performance degradation when SharpHound attempts to resolve unresolvable SIDs

When running SharpHound from a non-domain-joined Windows machine using supplied credentials, if target objects in the domain contain unresolvable SIDs (e.g., due to stale entries from broken two-way trusts), the tool repeatedly attempts to resolve them.

• Environment

1. SharpHound Version: 2.6.5
2. SharpHoundCommon Version: 4.2.6
3. Command : SharpHound -c DCOnly --ldapusername domainuser@ludus.domain --ldappassword ******** -d ludus.domain -v 1 --skipportcheck --disablecertverification --disablesigning --domaincontroller ludus.domain

• Conditions

1. The machine executing SharpHound is not joined to the domain
2. Some AD objects contain SIDs from a previously trusted domain (e.g., due to removed two-way trust)
3. unresolvable SID (from a previously trusted domain) was present on many AD objects.
4. Total object count is large (e.g., 500,000+ objects)

• Screenshot

1. non-domain-joined

2. domain-joined

• Observed Behavior

1. SharpHound attempts to resolve unknown or external SIDs via DirectoryContext using GetDomain(...)
2. Each failed resolution logs:
   System.DirectoryServices.ActiveDirectory.ActiveDirectoryOperationException: Current security context is not associated with an Active Directory domain or forest.

• Comparison Results

Is it possible to add unresolvable SID cache to avoid repeated requests or disable try get unresolvable SID?

Start by tracing the SID-resolution path that uses DirectoryContext and GetDomain(...), then reproduce the non-domain-joined command and compare behavior with and without the existing cache. Done means repeated failures for the same unresolvable SID no longer trigger repeated requests, or the resolution attempt can be disabled, with the observed timing and error behavior covered by verification.