passcore VS access-manager

If you don't have licenses for writeback, try passcore. https://github.com/unosquare/passcore

I've started using the free Manage Engine tool to remind people and had just enabled RDS web access on one of my servers so users can change their password. But as an alternative Passcore looked like a good alternative just to give users a nice simple web interface as some users don't actually logon to a PC often

You need to provide them both early warnings and some mechanism for SSPR or premature reset. This can be a notification script + a intranet page such as Passcore, or a standalone tool such as NoMAD.

This is what I’m using: https://github.com/unosquare/passcore

i use https://github.com/lithnet/access-manager as a pam. it gives you more control and insight into who is using admin access and that they only have it for a short period of time.

That's where JIT credentials come into play for people that need to install their own software. You can fairly easily set up something like that with LAPS or Lithnet (or both, https://github.com/lithnet/access-manager). If you have that many endpoints that need that much admin access, then any sort of ransomware is going to mess things up real fast if it gets in, and you'll be spending a lot more than 30-40 hours just getting things back up and running.

or you could use https://github.com/lithnet/access-manager

For example, Lithnet Access Manager is a relatively low-cost and open-source solution that can be rolled out in tandem with LAPS and then replace it if you need the extra features.

Just in time Access, this is what I setup on our domain, I'm sure there are others but this is free and easy to setup. The Enterprise Edition is cheap as well. https://github.com/lithnet/access-manager