I need to prevent users from logging into one workstation except 1 user.

I could accomplish that with adding a GPO to that workstation and enter that username to the "log in locally" securitysetting. But then i need to remove also the administrator group since our users are local admins through the DLU Policy which isn't a nice feature.

Are there any other ways to prevent users from logging into that workstation.

Workstation OS = Windows XP
We are using ZCM 11