There is no standard way to do this, but using Resource Kit Tools, and some freeware, you can script a solution. Here is one possibility:
1. Add the following statements to your logon script:
ifmember "Domain Guests"
if errorlevel 1 @echo . > %logonserver%\shutdown$\%computername%
where Shutdown$ is a hidden share on each domain controller (c:\shutdown).
Grant Everyone Full Control on the share and Add & Read NTFS permissions on the folder.
Grant SYSTEM and Administrators Full Control.
2. Use Launcher to prevent the logon script from being aborted.
3. Start a batch job (shutuser.bat) on each domain controller, using AUTOEXNT so it starts at boot:
start /low /min <drive>\folder\shutuser.bat
for /f "Tokens=*" %%i in ('dir /b c:\shutdown') do call :shut %%i
del /q c:\shutdown\%1
shutdown \\%1 /T:3600 /R /Y "You are authorized for 1 hour access"
Note: This procedure only works when the Domain Guest uses a Windows NT Workstation to logon to the domain.