I'm not sure your security expectations here are realistic.
If someone gets access to your DC in such a way that allows them to change arbitrary account passwords, then you've got plenty of bigger problems to worry about.
If they could re-boot the system in order to force their password change to take effect (after which point, your hypothetical additional security measures take effect), then they either have:
1.) Remote login access to the system, which means that they don't need to reboot the system for this purpose because they're already on it.
2.) Physical access to the system, which pretty much bypasses any additional logical security you have in place, short of hard drive encryption.
Let's say, for the sake of argument, that they are able to re-boot the system but are still unable to log into it. At this point, they've effectively DoSed whatever services the system provides which requires you to keep the system logged in at all times. Perhaps this is not as significant of a breach as if they actually got logical access to the system. But, depending on how critical those services are, it could have a significant impact on your organization.
The lesson here is to make sure your servers which require a high level of CIA (Confidentiality, Integrity, or Availability), such as systems running critical services and the domain controllers they answer to, are well secured physically, and separated from your other less-secured systems as far as possible both physically and logically.
I believe the saying goes something like: "If you allow someone (either intentionally, or through lack of adequate security) physical access to your system, then the system is no longer yours." The same goes especially for domain controllers. If you allow someone to run arbitrary commands on your domain controller, then the domain is no longer yours.