The use of full disk encryption can prevent some attacks that enable changing or clearing passwords.

Since DSRM is a potential attack surface for a malicious actor who has physical access, the local DSRM accounts should be secured to the greatest extent possible. The only way that I am aware of to view the status of other accounts is to boot in DSRM and use standard tools to view or edit local accounts and groups. And if there are other local admin accounts in the DSRM SAM, those can be a potential point of access or attack. If you need to reset the local admin account for security reasons (an admin left, a regulatory rule requires it, a password was compromised, etc.) then for a domain controller, the “local admin” account would be the DSRM (directory services restore mode) administrator password, which can only be reset through ntdsutil as above, or by booting into the DSRM environment and logging in with the DSRM credentials.ĭSRM requires physical access to the server, or access to the virtual console in the case of a VM or IPMI.