It seems that when you open the global security configuration page, configuration sections for all security realms and authorization strategies are loaded immediately. This may contribute to poor performance, and even robustness issues, since buggy security plugins could cause problems when not even in use. In particular it seems that the AD plugin on Windows produces a ComThread each time.

Probably f:descriptorRadioList, used most heavily from GlobalSecurityConfiguration/index.groovy, ought to use l:ajax to render configuration sections lazily. Or just be switched to use f:dropdownDescriptorSelector which already does that.