|It's been a while so I might be wrong but, it seems to me you can go into the user's profile and there's a place where you can specify that this particular user is only allowed to logon to the PC's listed. |
By default, no PC's are listed there so they can logon to any PC in the domain. Put in the hostname of the PC at their desk and it would be the only one they can logon to. Put in the hostname of several PC's and they'll be allowed to logon to those PC's. Don't add the hostname of the one you use and then the user won't be able to logon to it.