If the machines/accounts are joined to an Active Directory they can be remotely locked/shutdown.

This would require some competence though.