特定域控制器上PowerShell Get-ADGroupMember命令超时问题求助

上周团队发现部分PowerShell AD组管理脚本报错，定位到Get-ADGroupMember命令指向特定域控制器（DC）时会超时。环境核心信息：

• 共9台DC：5台Server 2022虚拟机，4台Server 2016物理机
• 问题仅出现在4台Server 2016物理DC上
• 正常DC执行命令毫秒级返回；受影响DC针对不足300个成员的组，命令会在5分钟后超时
• 开启ADWS调试模式对比日志发现：获取单组成员对象耗时1-2秒，但Get-ADUser等其他AD命令无明显性能差异
• 服务器整体资源充足，但执行命令时仅单核心活跃
• 近期IAM流程变更，用户对象从3万增至7万；DC健康检查、复制状态均正常
• 怀疑问题由Server 2016十二月更新导致，寻求下一步排查方向

慢DC的ADWS调试日志样本 #

ActiveDirectoryWebServices: [1/11/2025 11:47:05 PM] [31] GetADGroupMember: found sdsamGroupPrincipal CN=GroupX
ActiveDirectoryWebServices: [1/11/2025 11:47:06 PM] [31] GetADGroupMember: member of CN=XXX
DirectoryUtilities: [1/11/2025 11:47:06 PM] [31] GetTimeRemaining: remaining time is 00:05:09.5457365
ActiveDirectoryWebServices: [1/11/2025 11:47:06 PM] [31] PopulateObjectClasses: adding class top
ActiveDirectoryWebServices: [1/11/2025 11:47:06 PM] [31] PopulateObjectClasses: adding class person
ActiveDirectoryWebServices: [1/11/2025 11:47:06 PM] [31] PopulateObjectClasses: adding class organizationalPerson
ActiveDirectoryWebServices: [1/11/2025 11:47:06 PM] [31] PopulateObjectClasses: adding class user
ActiveDirectoryWebServices: [1/11/2025 11:47:06 PM] [31] GetLocalDnsDomainName: Retrieved domain name 'domain.name'
ActiveDirectoryWebServices: [1/11/2025 11:47:06 PM] [31] GetADGroupMember: member of CN=YYY
DirectoryUtilities: [1/11/2025 11:47:06 PM] [31] GetTimeRemaining: remaining time is 00:05:09.4051086
ActiveDirectoryWebServices: [1/11/2025 11:47:07 PM] [31] PopulateObjectClasses: adding class top
ActiveDirectoryWebServices: [1/11/2025 11:47:07 PM] [31] PopulateObjectClasses: adding class person
ActiveDirectoryWebServices: [1/11/2025 11:47:07 PM] [31] PopulateObjectClasses: adding class organizationalPerson
ActiveDirectoryWebServices: [1/11/2025 11:47:07 PM] [31] PopulateObjectClasses: adding class user
ActiveDirectoryWebServices: [1/11/2025 11:47:07 PM] [31] GetADGroupMember: member of CN=ZZZ
DirectoryUtilities: [1/11/2025 11:47:07 PM] [31] GetTimeRemaining: remaining time is 00:05:07.5925597
ActiveDirectoryWebServices: [1/11/2025 11:47:09 PM] [31] PopulateObjectClasses: adding class top
ActiveDirectoryWebServices: [1/11/2025 11:47:09 PM] [31] PopulateObjectClasses: adding class person
ActiveDirectoryWebServices: [1/11/2025 11:47:09 PM] [31] PopulateObjectClasses: adding class organizationalPerson
ActiveDirectoryWebServices: [1/11/2025 11:47:09 PM] [31] PopulateObjectClasses: adding class user
ActiveDirectoryWebServices: [1/11/2025 11:47:09 PM] [31] GetADGroupMember: member of CN=AAA
DirectoryUtilities: [1/11/2025 11:47:10 PM] [31] GetTimeRemaining: remaining time is 00:05:05.5456304

日志说明：第一条记录返回较快，后续每条成员查询耗时1-2秒

下一步排查方向建议 #

• 回滚验证更新影响：在一台测试用的Server 2016 DC上回滚十二月更新，重新测试Get-ADGroupMember命令性能，确认是否为更新引入的问题
• 检查ADWS线程模型：查看Server 2016上ADWS服务的线程配置，对比Server 2022的配置差异，确认是否存在单线程处理成员查询的限制
• 分析底层LDAP请求：用LDAP查询工具直接执行Get-ADGroupMember对应的LDAP请求（如查询组的member属性并解析对象），对比快慢DC的LDAP响应时间，定位是ADWS层面还是AD数据库层面的问题
• 检查用户对象属性索引：用户数量增长后，检查AD中用户对象的关键属性（如cn、distinguishedName）是否存在有效索引，是否因索引失效导致单对象查询变慢
• 监控AD数据库性能：执行命令时用perfmon监控受影响DC的AD数据库相关计数器（如NTDS\Database\DRA Inbound Bytes/sec、NTDS\LDAP Searches/sec），排查数据库访问瓶颈
• 测试命令参数优化：尝试给Get-ADGroupMember添加-Properties指定必要属性（而非默认返回所有属性），观察性能变化
• 检查CPU亲和性配置：确认是否强制ADWS或NTDS服务仅使用单核心，导致无法利用多核心资源处理查询

内容的提问来源于stack exchange，提问作者Justin Cervero