You can manually disconnect users in Server Manager and you can set logon time restrictions (with forced Logoff) in User Manager for Domains, but I prefer to use a batch file due to the enhanced flexibily it offers and the ability to schedule it. Here is a sample (note - a leading : is the same as REM):
:: If you have other logon servers, they can still process logons.
net pause Netlogon
:: Pausing the Server service prevents new logons and new connections on this "server".
net pause Server
net send /domain "Your session(s) will be disconnected in 5 minutes, please logoff."
::Sleep 5 minutes.
@ping -n 301 127.0.0.1>nul
::net session /delete /y will terminate all sessions/connections with this "server".
net session /delete /y
:: Perform other usefull work here like stopping services, backing up, starting the services.
:: To get the service names, browse the registry at <b>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services</b>
:: Example: net stop RemoteAccess
:: Enable the Service and/or Netlogon services that you paused.
net continue Server
net continue Netlogon
net send /domain "Logons and connections are now enabled."