Pwdquery Info

Run PWDQuery against two different DCs and diff the outputs. Mismatches in badPwdCount or pwdLastSet indicate replication latency or—worse—an undetected DC compromise.