@Smjert reported instances of Windows Domain Controllers having massive resource utilization and being killed by the watchdog when running this query. In his test environment, this new query performs much better.
