If only a standard user account is compromised, then changing the password once and leaving the account enabled should be fine. A hash will not work once the password has changed. It also won't work if the account is disabled. As a pen-tester myself, I wonder if the pen-testers were using Kerberos tickets. Under certain circumstances these can carry on working if a password is changed, or if an account is disabled OR even deleted (see links for the mitigation).
If a domain administrator account has been compromised, then it is literally game over. You need to bring your domain offline, and change EVERY password. Also the krbtgt account password would need to be changed twice, otherwise the attackers will still be able to issue valid Kerberos tickets with the information they have stolen. Once you have done all that, you can bring your domain back online.
Implement an account lockout policy, so that changed passwords can't be guessed. Don't rename your accounts. Attackers can easily find out login names.
Another important point is to train your users. They probably did something unwise that meant the account got compromised. The attacker might not even know the password, they may just be running processes as that account. For example, if you open a malware attachment that gives an attacker access to your machine, they will be running as your account. They don't know your password. They can't get your password hash, unless you are an administrator. Don't let users run as local admins on their workstations. Don't let domain admins log in to workstations with domain admin rights - ever!
Links for further info/mitigations: