Get-QADUser vs Get-ADUser

I'm just wondering why there seems to be such a massive performance difference between the Get-QADuser and Get-ADuser.  I know the QAD commands return a lot more data and I have to use them when I need access to the virtual attributes defined in my environment but the speed difference is a millennium apart.  

This takes 6 seconds - measure-command { Get-ADUser    -LdapFilter '(&(sAMAccountType=805306368)(!(|(userAccountControl:1.2.840.113556.1.4.803:=2)(employeeID=*)(employeeNumber=*))))' }  
This takes 2 minutes  - measure-command { Get-QADUser -LdapFilter '(&(sAMAccountType=805306368)(!(|(userAccountControl:1.2.840.113556.1.4.803:=2)(employeeID=*)(employeeNumber=*))))'     -proxy -SizeLimit 0 }  

2 minutes seems like a lifetime when debugging :-) 

I've taken to loading the AD commandlets more and more despite feeling that they are somewhat inferior to the Quest commandlets but convincing others that they shoul dbe using them is pretty hard when the first script they write using them runs so sloooooooly.


  • The thing is, technically you don't HAVE to use the proxy switch unless:

    1) You are relying on override account credentials in Active Roles to access your domain(s) and/or
    2) You are trying to work with virtual attributes

    ...and clearly, neither of these are true (100% of the time?) since you implied that you are (at least sometimes?) able to get done what you need using Get-ADUser?Relaxed

  • I have quite a lot of virtual attributes in my environment making the quest commandlets a requirement.  I still think the commandlets are great and would love to use them all the time and encouraging other to use them can be difficult when they see a performance dip.  I only use the quest commandlets now when I need a virtual attribute or am updating objects.  As you mentioned before adding an operationReason is invaluable.