Being away from the chalk face for a bit I keep thinking I would look into this when I had spare time. I had thought about making use of PXE to boot from a remote image that has a warning message that the computer can not be used at this time, but I have not had a chance to see whether this is possible and how it could be managed.
It might solve the issue of not having a sign with you when you notice a dodgy computer. Many times I have identified a dud machine, but have had to either go to the nearest cupboard to get a laminated sign or scribble something on a bit of file paper (which looks naff).
I do agree with the 'psychological' thing, though, in that if a computer is "on" the users think that means it's "theirs". Hence pulling the power lead out is useful - but sod's law this is the one time they actually check that it's plugged in, instead of calling IT...