I read in another thread that Lansweeper checks all of the domain controllers for lastLogon since it is not an attribute that replicates. But I have a feeling that when a Preferred Domain Controller is set in the scanning options, Lansweeper stops checking all of the domain controllers. That's a good thing, because some of the domain controllers are in far away locations over slow WAN links. That brings us back to lastLogonTimestamp. That attribute does replicate. So, Lansweeper pulling it in from the domain controllers it talks to will provide the most reliable information about whether AD accounts are dormant.