First of all, if you granted access to any Windows login or groups,
remove these. Second, also revoke access to BUILTIN\Administrators,
which gives permission to all Windows logins that have admin rights
on the machine.

Steve
I think the following has been introduced in SP2 and I did not test on
Express Edition ,sorry

/*Create a very simple login trigger */
create trigger AuditLogin_Demo
/* server means instance level*/
on all server
with execute as self
/* We specify the logon event at this stage
– Issue a rollback*/
for logon
as begin

if exists (select * from sys.server_principals

where type_desc ='Windows_Login'

and name=original_login() )

begin

ROLLBACK;
end
end
go

For more details please