Here is a simple command that I had a hard time finding.
Change Logon /Disable
Change Logon /Enable
It prevents users from logging on to the server that the command was ran on. All new connections will be disabled. Existing connections will not be disconnected. So you can run this with remote users logged in to stop new connections while you wait for people to exit.
You can run that from a terminal session. If you get disconnected, you will have to get physical access to the machine to activate it.
From the website: Enables or disables logons from client sessions, or displays current logon status. This utility is useful for system maintenance.