You can disable users from changing passwords in their local stations and to force them use only the domain password and policy by adding this line intoyour logon script:

writevalue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Network","DisablePwdCaching","1","REG_Dword")

try this in youe test envoirment and then pass it to production.

All the best.

------------------
Plan before,work later...