What you want is not a locking service but rather logon restrictions.
Start, Run, gpedit.msc
Local Computer Policy
Computer Configuration
Windows Settings
Security Settings
Local Policies
Logon rights
For the right to Logon locally, set just Administrators or a specific user. Remove entries for all other groups.
You can tighten security be preventing an network or service based logon, including Terminal Services in other areas of this panel. Be careful you do not disable the Automatic Update service as an unintended consequence.