EC2 Instance in us-west-2 is a domain controller and a excoworker changed the domain admin pass y blocked all usuer when he let the company

Thank you very much it could work but the problem is that there were not any previous snapshot :(

You could now take a snapshot and create a new instance and then use forensic tools against that new instance.

I am not a Windows expert -- perhaps someone else can comment on this -- but you may be able to use the following two articles to enable booting to safe mode and then change the password.

• https://aws.amazon.com/blogs/compute/using-the-ec2-serial-console-to-access-the-microsoft-server-boot-manager-to-fix-and-debug-boot-failures/
• https://www.clouvider.com/knowledge_base/how-to-reset-administrator-password-on-windows-server-2019/

Again, I am not a Windows expert and cannot speak to the full viability of these options.