Question: how domain controllers verify passwords?
Answer: The client computer sends the user logon information (user account name and a crypto hash of the password) to the 'nearest' domain controller.
DC tries to verify the password. ... 
PDC emulator retries the authentication. ... 
PDC Emulator informs the authenticating DC that the password didn't work.