It's not entirely clear what your situation is, but I see two possibilities.
1. You have cached domain credentials
In this case, it's working as designed. Windows will remember the last X logins in th event that a machine needs to be accessed, but a domain controller is unavailable. I think it's five by default, but you can turn this feature off with a GPO.
It's under Computer Configuration --> Windows --> Settings --> Security Settings --> Local Policies --> Security Options and the policy is named
Network Access: Do not allow storage of credentials or .NET Passports for network authentication. Enable it, and no more password caching.
Though, this will cause issues if you need to access a machine that's orphaned from the domain, so keep those local Administrator account passwords handy.
2. Your users are using the local Administrator account
Also working as designed - password expiration only applies to domain accounts, not local ones.
Fortunately, this can also be handled with GPOs. You'd want to disable or rename the local administrator account and change the password, which is also doable. The location of the various default GPOs for configuring the local administrator account are below.
In Group Policy Object Editor, click Computer Configuration, click Windows Settings, click Security Settings, click Local Policies, and then click Security Options.
I find it easiest to disable the Administrator account, with the GPO and deploy a new account with local permissions with GPP (
Local Users and Groups under
Control Panel), but the way you do it is up to you.