Thanks so much for your help, especially considering it is like doing surgery wearing mitts (with a clueless assistant on top of it).
I'm guessing "Recent Expensive Queries" would be the first place to look?
http://i.imgur.com/42LlFHW.png
424755 ms (7 minutes!) certainly looks like it could be the problem.
Does the SQL give you any hint what is going on here?
select T.UserKey, T.NAME, T.Alias, T.Domain, T.SecurityID, MAX(T.GeneralLedgerRoleType) GeneralLedgerRoleType, T.CompanyKey, T.IsEnabled
from (
select ui.RECID UserKey, ui.NAME, ui.NETWORKALIAS Alias, ui.NETWORKDOMAIN Domain, SID SecurityID,
CASE st.AOTNAME
WHEN 'SysSecSecurityMaintain' THEN 5
WHEN 'LedgerBalanceSheetDimMaintain' THEN 4
WHEN 'LedgerFinancialJournalReportBGenerate' THEN 3
WHEN 'LedgerBalanceSheetDimPrintGenerate' THEN 3
WHEN 'LedgerViewFinancialStatement' THEN 2
END GeneralLedgerRoleType, l.RECID CompanyKey, ui.ENABLE IsEnabled
from MicrosoftDynamicsAX..USERINFO ui
inner join MicrosoftDynamicsAX..SECURITYUSERROLE sur on ui.ID = sur.USER_ and ui.PARTITION = sur.PARTITION
inner join MicrosoftDynamicsAX_Model..SECURITYROLE sr on sur.SECURITYROLE = sr.RECID
and (GETUTCDATE() between sur.VALIDFROM and sur.VALIDTO OR
(sur.VALIDFROM = '1/1/1900' and sur.VALIDTO = '1/1/1900'))
inner join MicrosoftDynamicsAX..SECURITYUSERROLECONDITION c on c.SECURITYUSERROLE = sur.RECID and c.PARTITION = sur.PARTITION
inner join MicrosoftDynamicsAX..SECURITYROLEALLTASKSVIEW v on v.SECURITYROLE = sr.RECID
inner join MicrosoftDynamicsAX_Model..SECURITYTASKEXPLODEDGRAPH g on g.SECURITYTASK = v.SECURITYTASK
inner join MicrosoftDynamicsAX_Model..SECURITYTASK st on g.SECURITYSUBTASK = st.RECID
inner join (Select l.RECID, l.PARTITION, ci.DATAAREA from MicrosoftDynamicsAX..LEDGER l
inner join MicrosoftDynamicsAX..DIRPARTYTABLE ci on ci.PARTITION = l.PARTITION and l.PRIMARYFORLEGALENTITY = ci.RECID) l on ui.PARTITION = l.PARTITION and l.DATAAREA = c.DATAAREA
Where
ui.EXTERNALUSER = 0 AND
ui.[SID] != '' AND
ui.[ACCOUNTTYPE] = 0 AND
sur.ASSIGNMENTSTATUS = 1 AND
st.AOTNAME in (
'SysSecSecurityMaintain',
'LedgerBalanceSheetDimMaintain',
'LedgerFinancialJournalReportBGenerate',
'LedgerBalanceSheetDimPrintGenerate',
'LedgerViewFinancialStatement')
union all
-- get users and their assigned tasks for all companies where the task hasn't been constrained to a company
select ui.RECID UserKey, ui.NAME, ui.NETWORKALIAS Alias, ui.NETWORKDOMAIN Domain, SID SecurityID,
CASE st.AOTNAME
WHEN 'SysSecSecurityMaintain' THEN 5
WHEN 'LedgerBalanceSheetDimMaintain' THEN 4
WHEN 'LedgerFinancialJournalReportBGenerate' THEN 3
WHEN 'LedgerBalanceSheetDimPrintGenerate' THEN 3
WHEN 'LedgerViewFinancialStatement' THEN 2
END GeneralLedgerRoleType, l.RECID CompanyKey, ui.ENABLE IsEnabled
from MicrosoftDynamicsAX..USERINFO ui
inner join MicrosoftDynamicsAX..SECURITYUSERROLE sur on ui.ID = sur.USER_ and ui.PARTITION = sur.PARTITION
inner join MicrosoftDynamicsAX_Model..SECURITYROLE sr on sur.SECURITYROLE = sr.RECID
and (GETUTCDATE() between sur.VALIDFROM and sur.VALIDTO OR
(sur.VALIDFROM = '1/1/1900' and sur.VALIDTO = '1/1/1900'))
inner join MicrosoftDynamicsAX..SECURITYROLEALLTASKSVIEW v on v.SECURITYROLE = sr.RECID
inner join MicrosoftDynamicsAX_Model..SECURITYTASKEXPLODEDGRAPH g on g.SECURITYTASK = v.SECURITYTASK
inner join MicrosoftDynamicsAX_Model..SECURITYTASK st on g.SECURITYSUBTASK = st.RECID
inner join (Select l.RECID, l.PARTITION from MicrosoftDynamicsAX..LEDGER l
inner join MicrosoftDynamicsAX..DIRPARTYTABLE ci on ci.PARTITION = l.PARTITION and l.PRIMARYFORLEGALENTITY = ci.RECID) l on ui.PARTITION = l.PARTITION
Where
ui.EXTERNALUSER = 0 AND
ui.[SID] != '' AND
ui.[ACCOUNTTYPE] = 0 AND
sur.ASSIGNMENTSTATUS = 1 AND
st.AOTNAME in (
'LedgerBalanceSheetDimMaintain',
'LedgerFinancialJournalReportBGenerate',
'LedgerBalanceSheetDimPrintGenerate',
'LedgerViewFinancialStatement',
'SysSecSecurityMaintain')
and not exists (select 1 from SECURITYUSERROLECONDITION c where c.SECURITYUSERROLE = sur.RECID and c.PARTITION = sur.PARTITION)
union all
-- get all administrators for all companies where the admin's aren't limited to specific companies
select ui.RECID, ui.NAME, ui.NETWORKALIAS, ui.NETWORKDOMAIN, SID, 5 RoleType, l.RECID, ui.ENABLE IsEnabled
from MicrosoftDynamicsAX..USERINFO ui
inner join MicrosoftDynamicsAX..SECURITYUSERROLE sur on ui.ID = sur.USER_ and ui.PARTITION = sur.PARTITION
inner join MicrosoftDynamicsAX_Model..SECURITYROLE sr on sr.RECID = sur.SECURITYROLE
and (GETUTCDATE() between sur.VALIDFROM and sur.VALIDTO OR
(sur.VALIDFROM = '1/1/1900' and sur.VALIDTO = '1/1/1900'))
inner join (Select l.RECID, l.PARTITION from MicrosoftDynamicsAX..LEDGER l
inner join MicrosoftDynamicsAX..DIRPARTYTABLE ci on ci.PARTITION = l.PARTITION and l.PRIMARYFORLEGALENTITY = ci.RECID) l on ui.PARTITION = l.PARTITION
where
ui.EXTERNALUSER = 0 AND
ui.[SID] != '' AND
ui.[ACCOUNTTYPE] = 0 AND
sur.ASSIGNMENTSTATUS = 1 AND
AOTNAME in ('SysSecSecurityAdministrator')
)
T
Group by T.UserKey, T.NAME, T.Alias, T.Domain, T.SecurityID, T.CompanyKey, T.IsEnabled
order by T.CompanyKey