The easiest thing I found was once we got back into the system was to disable the Windows account login on the device and have the password set back to locally,

The easiest thing I found was once we got back into the system was to disable the Windows account login on the device and have the password set back to locally, and let them have a password that they like. Having some external entity be the gatekeeper for basic use of your device increases the potential for being locked out for no fault of your own.