If the computer being connected to is a BDC for the domain in which the user account is defined but the BDC fails to authenticate the user's password, this indicates that the password has changed but the BDC is not synchronized at the time the user logs on. In this case, the BDC passes the logon request through to the PDC in the same domain.
As a precaution, users who change their passwords should log on to all computers to which they have access within about 15 minutes of making the change. This ensures that the cached credentials are up-to-date on each machine and that the user will be able to log on with the cached credentials even if the PDC is unavailable during logon.