CPE
Attackers may reset the Directory Services Restore Mode (DSRM) administrator password on Domain Controllers to maintain persistent, high-privileged administrative access.