Here is the problem:
We have a large number of people working remotely now (like everyone else). Organizationally we are in a transition between being engineered towards the LAN and having cloud based tools. What this means is that our AD is not fully accessible to remote users without VPN. But, a chunk of users can do their job without needing to use the VPN. For the short term are there any concerns that you all would have about changing (assuming we can, haven't dug in that far yet) the expiration of the machine account/password?
I know this is not the best answer. I'm just trying to buy time before we can get some tooling implemented to fix the underlying management problem.