If you could get physical access to a server, you could change the root/admin password even if you did not know the current password.  

However with encrypted disks, I don't think this is possible (or is it?).  

So, does this mean physically securing your server has become less important - it's still needed for other reasons - but is this reason no longer there?  

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks):


Theft - An attacker could steal the server or disks, to attack at their pace. This allows an attacker to take their time, and you have no idea if they've actually gained access to data.
Physical Modification - If I can access a server, I could add hardware, this could be anything from USB or keyboard logging to adding a wireless interface to allow remote access.
Cold Boot Attack - There are attacks that can be used to extract encryption keys, allowing decryption of the disks.
etc.


There are others of course, but this is just a sample of what can happen if an attacker has physical access. There are possible attacks that are still somewhat theoretical, such as applying backdoored UEFI images and the like.

Possibly the worst part of a physical attack, is that you may not even know what exactly was done, so there's a real problem with being able to trust the hardware afterwards.
