This'd take some work. but you could configure multiple IP's (or NICs) and do quasi out-of-band management.
So, each server has two IP's - a 'public' one (The current one, registered in DNS etc) and a 'management' IP which isn't registered in DNS (This is important!!). When you want to do maintenance just disable the public IP.
The ideal would be two NIC's running on two different VLANs, but it'd still work on a flat network.
Other than that I don't know of a generic way to disable logons, unless you can do something application specific (I.e., disable a share, or disable terminal services if it's a terminal server etc) |