asked on

PowerShell script that controls the number of LDAP queries

Hi all, I am looking at LSASS process on a DC and have a question.
In my lab the reading I get for LDAP or Kerberos reads, are understandably small. I was wondering if by using PowerShell script, we can provide a parameter that control the number of queries. So, run script, enter 100,000, so that the query runs 100,000 times, and then I can see the performance counter utilisation being hit?

Any ideas appreciated?
Thank you.

Chris Dent

I'm not sure you'll get what you need without significant multi-threading. You can try though:

for ($i = 0; $i -lt 100000; $i++) {
    $searcher = [ADSISearcher]'(&(objectClass=user)(objectCategory=person))'
    # Find and discard the results.
    $searcher.FindAll() | Out-Null
}

Open in new window

The code above runs each search in sequence and waits for the results each time. The overall loading will be quite light I think.

Note that I'm deliberately avoiding the MS AD module for this, it uses a web service, the client workload is completely offloaded and you have no control at all over sequencing / threading.

Realistically I think you want to look at something like this:

https://blogs.technet.microsoft.com/askpfeplat/2014/02/09/how-to-use-the-active-directory-performance-testing-tool-on-windows-server-2012/

Attempting to do the same in PowerShell... wrong language, too heavy,

Jay Thomas

ASKER

Hi Chris, I think that will work. What I need though is a 'run how many times' parameter, so that when loaded in PS ISE, and run, it asks me for the value and I add 100,000 (for example). Is this something easily accomplished?

Failing that, here is a command I can use using ldifde:
ldifde -d "dc=Contoso,dc=Local" -f c:\temp\ldif.txt -l nothing -r (givenName=fred)

I just don't know how to put that is PS script, with the parameter to control the number of runs. I need to control the volume of queries otherwise I cannot generate the LSASS traffic.
Thanks

Chris Dent

Save it as a script (.ps1) and ISE should prompt for a number because it's a mandatory parameter now. Everything is still on a single thread, so the impact on your environment will still be small of course.

param(
    [Parameter(Mandatory = $true)]
    [Int32]$NumberOfQueries,

    [String]$LdapFilter = '(&(objectClass=user)(objectCategory=person))'
)

for ($i = 0; $i -lt $NumberOfQueries; $i++) {
    $searcher = [ADSISearcher]$LdapFilter
    # Find and discard the results.
    $searcher.FindAll() | Out-Null
}

Open in new window

Jay Thomas

ASKER

I'll try it right now. Thank you thus far, very much appreciated.

Jay Thomas

ASKER

Hi Chris, your assumption was correct, I can see some traffic but not enough for what I want. Would you mind, for completion, if I wanted to use this command line:
ldifde -d "dc=Contoso,dc=Local" -f c:\temp\ldif.txt -l nothing -r (givenName=fred)
In a script with that same parameter, is that something you can show me quickly do you think?
Thank you.

ASKER CERTIFIED SOLUTION

Chris Dent

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Jay Thomas

ASKER

Fantastic Chris, that one response is worth the cost of EE membership!
Also, just to share, when I run your first script on my lab DC, and watch the %ProcessorTime for LSASS process, it goes from almost zero utilisation to averaging 50% - so the script does work from a 'cpu utilisation perspective', but not from a thread depletion one, because as you pointed out, single thread etc.
Thank you mate.