Why is WMI so much slower tha using utilities like PsExec or PsList?

Question

I'm doing various OS management and querying tasks using WMI, but it allways take a long time for first WMI call(10 to 15s). When I tried few tools from sysinternals I found that they are so much faster and I want to know how is this possible. For instance how can PsList tool returns result in under 2 second and for wmi it takes at least 15 seconds. Much of this time is used for authentication and not actual work, and next wmi query for the same machine is much faster.

Is possible to see the source code of sysinternals utilites ? Do they use WMI or direct win32 api calls ?

Answer 1

WMI has a lot of overhead: authentication/authorizing access to WMI namespaces/DCOM/RPC. It is designed for easy and secure management, not for performance.

Suggested reading: WMI: Improving your WMI application performance in fan-out scenario