Home or Remote Users

users who work from home, have their computer assigned by the company (joined to the company), if they are in the local network, they can initiate the Secure Password and change their password or unlock themselves by failed attempts.

But when they are working from home, we had published Password Manager with SSL, they can enter from home and change the password, but if they try to enter the computer with that password they cannot because they are not in the company's local network. How do I solve that, everyone has access to the VPN, but if they block or forget their login password they can't lift the VPN to do the password-change?