If the machines are Win32 then you could use Win32::NetAdmin to disable the user account. Then when they are allowed back on, you could reenable it. I believe you have to set some flags in the UserSetAttributes method to disable accounts.