Performance of queries against large AD CS databases - how to optimize?

Question

I am asking experts with experience with AD CS databases with 100.000s or millions of certificate to confirm or correct my "theories".
I am aware of these two articles that state performance is not an issue for millions of certificates:
Windows CA Performance Numbers and
Evaluating CA Capacity, Performance, and Scalability
However, here performance is mainly evaluated in terms of database size and request / certificate throughput. I am more interested in the performance of queries as I have seen that it might take minutes to build up views for databases with 100.000s of certificates
- no matter if you use certutil -view, certsrv.msc, or access to CCertview.
Could this just be due to an "unfortunate" combination of non-indexed fields? Any advice on which queries to avoid?
Or is the solution just as simple as to throw more memory or CPU or both at the problem?
In case it hinges on an unfortunate choice fields and you absolutely have to do this query my guess is that you have to use a custom policy(*) module (FIM or third-party) to dump certificates to a SQL database and do your queries there.
Am I right or did I miss something? Any input is highly appreciated!
Elke
PS / edit: That should have been 'Exit module' - I don't know why I wrote Policy Module. Thanks for Vadims for pointing it out.

Answer 1

> I meant 'exit module'
exit module is correct one. However, it is notified by a CA only when new request is issued/processed. This means that you can use Exit Module to copy certificate information to SQL only for new requests, for existing requests you are still sticking
with a database dump.
> but I should probably check how I dealt with the row handles
I don't know how COM handle are working in VBS, but in PowerShell (and other CLR languages) COM handle may not be handled properly by a garbage collector, therefore, when COM object is not necessary, you should set reference count to zero. In CLR it is made
by calling Marshal.ReleaseComObject method. This will mark COM object as safe for garbage collector. For example, the typical row/column iterator scheme is:
$Row = $ICertView.OpenView()
# do row iteration
while ($Row.Next() -ne -1) {
# acquire IEnumCERTVIEWCOLUMN COM object
$Column = $Row.EnumCertViewColumn()
# do column iteration for the current row
while ($Column.Next() -ne -1) {
# collect column information and other stuff
# do other stuff if necessary
# release IEnumCERTVIEWCOLUMN object. This is the last line in the while/do loop.
[Runtime.InteropServices.Marshall]::ReleaseComObject($Column)
# release IEnumCERTVIEWROW COM object as well
[Runtime.InteropServices.Marshall]::ReleaseComObject($Row)
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.