none
Slow WMI Query Executed by CcmExec.exe RRS feed

  • Question

  • I have noticed a long WMI Query execution time of  select * from SMS_UserLogonEvents where LogoffTime > 1573114465 which costs one Core for 40s. This one runs after Boot and is executed by CCmExec.exe. Is this one really necessary and why is it so slow? 

    PS > Measure-Command  { Get-WmiObject -query "select * from SMS_UserLogonEvents where LogoffTime > 1573114465" -Namespace "root\cimv2\sms" }

    Seconds           : 39



    I would expect faster query performance or is some specific event log so slow/huge? 



    • Edited by Alois Thursday, November 21, 2019 6:33 AM
    Wednesday, November 20, 2019 4:11 PM

Answers

  • See https://docs.microsoft.com/en-us/configmgr/apps/deploy-use/link-users-and-devices-with-user-device-affinity

    Jason | https://home.configmgrftw.com | @jasonsandys

    • Marked as answer by Alois Sunday, November 24, 2019 10:03 AM
    Wednesday, November 20, 2019 6:54 PM

All replies

  • Automatic UDA assignment would be my guess for this.

    Where are you seeing that this is executed?


    Jason | https://home.configmgrftw.com | @jasonsandys

    Wednesday, November 20, 2019 4:49 PM
  • I have written a WMIWatcher to track all WMI Queries because so much crap software is relying on WMI where no direct responsible is evident. 

    https://github.com/Alois-xx/WMIWatcher

    Now I see every ....  WMI Query from everyone and can fight slow performance. So this is coming from scanning Security Event log. This one is 256 MB size and pretty frequently audited (corporate audit policies ...). That can explain it a little bit. 

    What is this feature all about? What are the gains? 



    • Edited by Alois Wednesday, November 20, 2019 5:44 PM
    Wednesday, November 20, 2019 5:43 PM
  • See https://docs.microsoft.com/en-us/configmgr/apps/deploy-use/link-users-and-devices-with-user-device-affinity

    Jason | https://home.configmgrftw.com | @jasonsandys

    • Marked as answer by Alois Sunday, November 24, 2019 10:03 AM
    Wednesday, November 20, 2019 6:54 PM