Slow AD group sync
Solution 1:
Don't use the LDAP matching rule transitive evaluation for recursive group membership. It is notoriously slow, particularly with large directories/group memberships.
https://stackoverflow.com/questions/40024425/1-2-840-113556-1-4-1941-ldap-matching-rule-in-chain-has-performance-problems
http://dunnry.com/blog/TransitiveLinkValueFilterEvaluation.aspx
https://stackoverflow.com/questions/9534669/improving-recursive-active-directory-function