How to "softly" block the user's work on a domain computer?

Question

Active Directory

Hello.
In short: you need to remotely temporarily block the work of a logged in user and his interaction with the OS and software on the domain network on one of the computers (xp, 7) without harming (un)saved data and without interrupting the session itself and running work applications and without changing anything in user settings, say password. At the same time, it will not be superfluous to be able to show a noticeable (full-screen?) message on top of everything. And a quick unlock with a smooth continuation of the user's work after that.
The task arose from recurring situations of this kind: the user in an endless loop does "something that is not possible" and does not react to external influences - therefore, it becomes necessary to interrupt this process by blocking its work on the computer entirely and at the same time force it to dialogue. Any "administrative" impact on the user to force them not to violate the policy is now outside the scope of the task, incl. because it is relatively long, and the primary goal is to stop the violation.
In fact, we need a kind of harmless managed "winlocker" of instant action :) All that we managed to find is How to carefully put a "stub" on the GUI of Windows 7? and blog.commandlinekungfu.com/2009/05/episode-35-remo... andserverfault.com/questions/397684/how-can-i-lock-ou... - curious, but requires reboots and/or password changes, which is why it doesn't work.
Any advice on what to do with this?

Answer 1

RAdmin+KidKeyLock ;-)

Answer 2

It seems to me that it is easier to set it up so that the user cannot perform this action than to ban him for it)