If you can, consider replacing tbeir computer with something else completely. If they use a desktop computer, replace it with a decommissioned desktop server o

If you can, consider replacing tbeir computer with something else completely. If they use a desktop computer, replace it with a decommissioned desktop server or a workstation with ipmi/idrac/iLO: you can do most remote management through it (including power cycle and os install/reinstall). You can password-protect access to it and you'll have to setup a vpn connection to be able to access it. It's really the bes you can do, albeit a bit expensive.