I have a good idea... just disconnect any keyboards, mice and monitors. Problem solved. No local access. What your doing is not feasible. I understand you want your admins to remotely administer the boxes, but I think you underestimate the need to locally access machines once in a while. Removing any way of accessing the system is the best way to limit access, don't you think?