Local Administrator account control

We need to give some users with local admin access to run and update different testing applications at client side.

They are working remotely on client sites or as testing engineers and did not connect to domain for months.

I am looking for any group policy setting which trigger, lets say, after 2 months and revert admin access or change admin password?

OR

Is there any tool (agent based) on which we can push a password rest setting whcih can audit the activities for that interim period (2 months) performed with privileged local admin access?