What I have done on my SCO Openserver system is add the following to the /etc/profile:
########################################################
# If you remove the # users will not be able to login #
# to allow users back on put the # (comment) back at #
# the beginning of the lines. #
# Do not remove the # from these comment lines, start #
# with the line that has the case and the last line #
# is esac. #
########################################################
# Start below here. #
########################################################
case `logname` in
root) echo "Only root can log in.";;
*) echo " "
echo "System Maintenance is being performed."
echo "Please try later ...."
echo " "
exit;;
esac
########################################################
# End above here. #
########################################################
This allows me to keep the system up in multiuser mode and not allow any new users on the system, unless they have the root password. You would still need to get users off the system, if there were users on prior to implementing this. You can then comment out the script to allow other users back into the system.