How do you handle password changes on domain-joined PCs that are usually off-site?

A pre-login or always-on VPN is a good fit. The PC needs network access to a domain controller at sign-in so Windows can validate the new password and update its cached credentials.

It also helps with a first remote sign-in on a new or replacement PC, where there may be no cached domain credentials yet. Check that your VPN supports connecting before user login and that DNS and domain controller access work over the tunnel.

If pre-login VPN isn't available, have users connect to the VPN, change their password, then lock and unlock the PC with the new password while the VPN is still connected. Test the workflow with your password-change system before rolling it out, since the timing and behavior can vary.

Entra ID joined devices are another direction if you're ready to change the device and identity setup. Intune can handle policy, and password writeback may be useful in a hybrid environment. Neither is just a switch you flip to fix the current domain-joined PCs, though.

Check dependencies on on-premises resources first. Cloud Kerberos trust can help Entra-joined devices access supported on-premises resources, but it needs planning and doesn't automatically resolve every legacy dependency.

You could also look at certificate-based or passwordless sign-in as a longer-term change. A machine certificate can establish connectivity, while a user certificate on a hardware token can handle user authentication. That's a bigger project than fixing the immediate cached-password problem, but it may be worth considering alongside the VPN design.

Whatever route you choose, give users a clear password-change process and reminders before expiry. That won't update a cached Windows login by itself, but it gives people time to connect and change their password before they're locked out of the usual workflow.