You want a simple solution? Lock up the hardware! Literally!
What you need to have is some safe or a closet with a lock on it. Put the PC in this safe and drill a few holes in the safe so the keyboard, mouse, power, network and monitor cables can still be connected to this system. And maybe an opening for the user to press the Power switch of the computer. Then lock this safe...

The advantage of this system is that whomever is responsible for the hardware maintenance, they can still access the computer since they have the key. The user, however, cannot. Even if the user has administrator rights, he still can't connect any hardware to the system thus he has no "physical" access to it. Yet the system is in no way crippled by some software or hardware solution.

And what if the user breaks open the lock of the safe? Well, it doesn't have to be strong enough to keep out any thieves. A simple wooden box would be more than enough. But when you discover that a user has been tampering with the lock, you should have a serious discussion with that employee, about breaking office materials...

And keep in mind, a system can always be hacked, especially if the hacker has physical access to the system. By building it into a safe, this physical access will be denied.
Of course, make sure your users aren't administrators on their own machines or they could bypass many other security measures you've set up. And make sure that any hubs and switches are also locked away safely, so no user can plug out a cable and replace it with it's own...