How do I prevent a domain user from logging onto a certain domain computer?

I need to prevent a certain domain user from using a certain domain computer. I'm using Server 2003 Active Directory. Computer is running XP Pro.
I need to restrict the user to all but one computer - I'm guessing I need to create some kind of local policy on the workstation?

---

Orignal From: How do I prevent a domain user from logging onto a certain domain computer?