you cant set a policy to not allow them to log on as "work station only"?