Kiosk control

I wish to use a kiosk type operation (auto logon with very limited use of network for customers/staff to use internet order system, lead generation ECT)
From this “open” kiosk I would like field staff to be able to logon and use different applications say “time management system? using resources that the kiosk does not have access to.
How do I from this already logged on machine force the user to logon using his username and password to be validated by Active Directory 5.2 complete the higher security function cause auto logoff and re-logon as Kiosk without creating a TJMAX security nightmare