As discussed previously, the first of these steps, on Windows computers, makes use of a technology called WMI. The auditing agent uses WMI to issue a series of WQL statements to the PC that is being audited and receives, in return, various pieces of information about the hardware and software that exist on that machine. The number of WQL statements that are issued and the amount of information that is transferred both depend, to some extent, on the number of hardware and software components present on the machine. However, since the number of hardware components will not typically vary to any great extent from machine to machine, the main factor that will influence data transfer and audit times, whilst auditing a particular PC, is the amount of software installed on that PC.
In general, a machine that does not have many software products installed can be audited locally (by EntAudit.exe) in around 3-10 seconds and the audit would involve the transfer (back and forth) of around 1 MB of information, between the auditing agent and the PC that is being audited. On a PC that has a lot (hundreds) of software products installed, an audit might take as long as 30 seconds and involve the transfer of 2.5 to 3 MB of information.
On a Gigabit LAN connection, the transfer of a couple of megabytes of information (especially over the time frames that we're considering) is of almost no consequence what so ever, and the audit might take only slightly longer (another few seconds perhaps). However, if you are auditing machines over a 256 kbps DSL, then this transfer of information might not be so inconsiderable.
