Your company has a main office and 40 branch offices.
Each branch officeis configured as a separate Active Directory sitethat has a dedicated read-only
domain controller (RODC).
An RODC server is stolenfrom one of the branch offices.
You need to identify the user accounts that were cachedon the stolen RODC server.
Which utility should you use?

A.
Dsmod.exe

B.
Ntdsutil.exe

C.
Active Directory Sites and Services

D.
Active Directory Users and Computers

Explanation:
http://technet.microsoft.com/en-us/library/cc835486%28v=ws.10%29.aspx
Securing Accounts After an RODC Is Stolen
If you become aware of a stolen or otherwise compromised read-only domain controller (RODC), you should
act quickly to delete the RODC account from the domain and to reset the passwords of the accounts whose
current passwords are stored on the RODC.
An efficient tool for removing the RODC computer account and resetting all the passwords for the accounts that
were authenticated to it is the Active Directory Users and Computers snap-in.