[Samba] controlling concurrent domain logins?

[Jeff Davis]

Hi,

Is there a way to prevent users (or ideally members of certain groups) 
from logging into the samba domain on more than one machine at a time?

I found some examples in the samba guide using preexec parameters but 
this approach appears to only prevent access to the resource, does not 
prevent the user from being able to use the workstation, which is my goal.

I've seen this question asked but never really answered in the archives. 

Is there a pam module that might facilitate this?  radius?  I'm open to 
almost any server-centric approach to this.

Any ideas?