If you remove the Active Directory Group ADDomain Users from the Users Group Properties, then non-administrative Active Directory accounts will not be able to log into the machine from the keyboard.