Analysing Active Directory database -NTDS.DIT- using NTDSUtil

You have to stop the AD service to do this, but as long as you have more than one DC and they’re not too overworked I’m sure you could do this any time.