I'd strangle anyone making substantial network changes for such a temporary thing. I realise he doesn't have to commit them, but still.
Besides, he's probably going to be accessing it from the same IP range as his users if he's VPNing in.
Terminal Server, why didn't you say? What OS is it?
http://blogs.msdn.com/b/rds/archive/2007/06/15/introducing-terminal-services-server-drain-mode.aspx
Does that point you in the right direction?