 Anyone with the password who has access to the domain controller can reboot the machine, copy and modify the Active Directory database, and reboot the server without leaving any trace of the activity.DSRM password changes cannot be scripted, but can be accomplished manually through the command line; DSRM passwords can also be automatically changed and audited using Privileged Identity Management software.Microsoft Windows Server 2008 R2 has introduced a new Active Directory "Recycle Bin" feature, which works analogously to the well-known Windows recycle bin.