It seems like this should be pretty easy to do but I'm struggling to find a way.  I don't want to spend a lot of time on this, but the customer would like to restrict anyone with Windows XP from logging onto their system.  Specifically, they'd like to stop them from accessing Citrix applications but even if I could do this right at Windows logon, that would be great.

Does anyone have a fairly simple idea or method to accomplish this?

Thank you.

It's a bit unclear what you exactly mean by 'logging on to their system'.

If you want XP to be unable to communicate with some service, you could enforce the server to use protocols and/or ciphers that XP does not know (like configuring SCHANNEL to use TLS1.2 , shares to use SMB 2.0).

Depending on the configuration and the clients that need to be service, you might also want to consider technologies like Network Access Protection or Network level Authentication.

In my opinion, unless your customer is running a public service, he might be making a crucial security mistake. He should consider who is allowed to use the services, not who is not.