Your company has a main office and 40 branch offices. Each branch office is configured as
a separate Active Directory site that has a dedicated read-only domain controller (RODC).
An RODC server is stolen from one of the branch offices.
You need to identify the user accounts that were cached on the stolen RODC server.
Which utility should you use?

A.
Dsmod.exe

B.
Ntdsutil.exe

C.
Active Directory Sites and Services

D.
Active Directory Users and Computers

Explanation:
http://technet.microsoft.com/en-us/library/cc835486%28v=ws.10%29.aspx
Securing Accounts After an RODC Is Stolen
If you become aware of a stolen or otherwise compromised read-only domain controller
(RODC), you should act quickly to delete the RODC account from the domain and to reset
the passwords of the accounts whose current passwords are stored on the RODC.

An efficient tool for removing the RODC computer account and resetting all the passwords
for the accounts that were authenticated to it is the Active Directory Users and Computers
snap-in.