If the machine is authenticating to W2k or W2k3 server, you could apply restrictions via a Group Policy. On a standalone machine you can run GPEDIT.msc. Working with these policies is not particulary easy, but you probably can do what you'd like to do with them. As for applying them to just a single user, I'm not sure how that'd work. There may be a 3rd party that's written a package to make this easy, but I'm not aware of one.

-Zeke