My usual reply to said employees is “if you know how to install and configure a Linux distro, you probably also know how to solve your own problems”. Everything else is pretty much deployed over AD, so if you can get to the point where you need admin creds to hook to the DCs, then do whatever you like.

Eventually, all of them failed to even get close to being a part of the AD DC and that is where the story ended.