You could make a form in Kixforms as the Doc suggested earlier. And make that form initiate at the end of the loginscript have an Accept and Deny button. If they press the accept button, write the @userid value. If they press the deny button initiate shutdown.exe, write it back to an deny ini, and have an admin script check the deny ini regularly to disable the denied account in the AD.

Anyway thats just my idea.