ntdomains is slow
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 23.6k
- Forks
- 2.6k
- Avg merge
- 6d 7h
- Merged PRs (30d)
- 14
Description
Bug report
I don't know if we can fix this, or if there's another interface to the data, but querying ntdomains takes about 5s on a host without a windows domain. This seems weird.
It seems that the underlying WMI query itself is slow. From powershell, you can Get-WmiObject -query "select * from Win32_NtDomain"
I see some indication that there might be an ADSI interface to this data.
What operating system and version are you using?
Windows 10 Pro Version 10.0.17763
What version of osquery are you using?
osquery 3.3.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the ntdomains query on Windows 10 and compare its behavior with the PowerShell Win32_NtDomain WMI query. Investigate whether an ADSI interface can provide the same data, and consider the work complete when querying hosts without a Windows domain no longer incurs the reported delay.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100