Why is WMI so much slower tha using utilities like PsExec or PsList?

Question

I'm doing various OS management and querying tasks using WMI, but it allways take a long time for first WMI call(10 to 15s). When I tried few tools from sysinternals I found that they are so much faster and I want to know how is this possible. For instance how can PsList tool returns result in under 2 second and for wmi it takes at least 15 seconds. Much of this time is used for authentication and not actual work, and next wmi query for the same machine is much faster.

Is possible to see the source code of sysinternals utilites ? Do they use WMI or direct win32 api calls ?

Louettalough

Sysinternals hasn't distributed code for many years, but they wouldn't use WMI. They typically use a combination of Win32 API calls, NT Native API calls, and device drivers. – Innocent

Is it possible to get code from old versions of sysinternals ? I couldn't find a workable link for download. – Louettalough

Answer 1

WMI has a lot of overhead: authentication/authorizing access to WMI namespaces/DCOM/RPC. It is designed for easy and secure management, not for performance.

Suggested reading: WMI: Improving your WMI application performance in fan-out scenario

Junoesque