Well, the servers have an agent, and I've seen some "aftermarket" agents for Windows servers as well. But documentation on what the agents can do seems strangely light, or non-existent. So the question is whether these agents can make AD changes or not.