Controlling Domain Logins??

Hello everyone, here at school we've sucessfully bound a mac mini to the windows domain server here on campus. What is puzzling right now is that we are unable to prevent any user on the entire domain from logging in. It wouldn't be a big deal if only administrators of the domain could, but currently anyone at this school with a network login (every student, staff, and faculty member) can gain access to the machine. Any ideas?

We just tried the idea of simply "locking" the screen when we're out of the office, however there's still the option of switching the user, so we're still stuck at step 1.

Someone must know something regarding this. I've convinced this coworker to try out a Mac as his primary computer in the office and now it appears as though it isn't as secure as his former PC setup.