Locking down users in a workgroup

[Issa]

How do you lock down a single user account when the
machine is in a workgroup? Local Group Policy applies to
all users including the local administrator.

Thanks in advance.