Kiosk control

I wish to use a kiosk type operation (auto logon with very limited use of network for customers/staff to use internet order system, lead generation ect)
from this “open” kiosk I would like field staff to be able to logon and use different applications say “time managment system” using resorces that the koisk does not have access to.
How do I from theis allready logged on machine force the user to logon using his username and password to be validated by Active Directory 5.2 conpleate the higher security function cause auto logoff and re-logon as Kiosk without creating a TJMAX security nightmare