You could also do something like a default autologin with a user that has little to no local/network privledge and launches into Thinshell to authenicate the users 'real identity' to a desktop/application served via vWorkspace.  But, then the end user also has the option to 'log off' of thin shell and connect to the local explorer.exe shell for local computing.  The article Rick references is helpful in this as well.
Is there a an easy way of allowing users to choose between WindowsShell or Thinshell?  We are in the process of rolling out terminal services in a call centre. Currently they have about 400 desktops and we are converting the desktops into thin clients useing Thinshell. A great solution, well done Quest.  I have set up a set up an OU to deploy the relevant software and also to make the registry update and this works very well because we can control the rollout by moving pcs into the OU in a controlled fashion.  The problem is that our users hot desk and need to be able to choose between TS or desktop without calling the helpdesk.  We have had a very brief look at ZeroPC and is probably a more suitable solution. We look forward to that being released, no preasure then chaps.
Thinshell - Choose between WindowsShell or Thinshell