I have a maintenance script that needs to run uninterrupted, so I'd like some way to disable local user logins. Right now, the solution is to send SIGSTP to the loginwindow process, which is suboptimal for several reasons. The most important of them is that the observed behavior is a login prompt that appears to accept the user's credentials but then hangs on a blank desktop before the menu bar or dock or desktop icons appear. This has led to users "fixing" the problem by rebooting the machine.

Is there a better way to disable local logins?

We currently use iHook, so if there's any way to abort a login from within the login hook, that would integrate nicely with our current setup. Unfortunately, Apple doesn't seem to have documented exactly what would cause Mac OS to abort the login.