The problem with physical security is this:
If the attacker has physical access to the machine, then there is no security.
Unfortunately, there is very little that can be done about it for a end-user workstation. Where I work, we use workstations that really are desktops. So placing a security sticker on the case in front in plain sight of the end-user is easy. Case intrusion systems can send an alert if the case was opened, but those can also be countered as well. The best security solution that I can think of is four fold.
Physical access controls to the location where the computers are kept. Employees who are authorized to work in that location can use either a RFID card or some magnetic stripe or barcode on their ID badge to gain access through a locked door. This allows the accesses to the location to be audited on a per employee basis.
Force the users to use two factor authentication: Something that you know with something that you have. There are several solutions on the market for this. One example being the widely popular RSA SecurID tokens.
Do not store sensitive data on the end-user machines. Only store it on the server. Enforce data security using network access controls.
Educate your users.
An interesting effect of #1 is that if a user logs into a computer at a location in which there is no record of them accessing the location, that discrepancy can be flagged for review. Also, configure a solution that displays, prominently, upon login the last time they logged in and the duration of the login. Unix machines do this already, but I have not seen this with Windows machines.
For servers, machines are usually stored in a back room somewhere. Instead of using a key to enter a locked server room, use the method for #1. That way, access is restricted to the room, access audits can be performed, and if someone is let go for some reason, you can remove them from the access system and not worry about them having made a duplicate key to the room.
As a side note, I would like to mention that a if a sufficiently motivated attacker gained access to a computer and removed the hard disk, not even a hardware password for the harddisk will stop them from gaining access to the data stored on the drive. I read somewhere awhile back that the drive itself stores the encryption key, in the clear mind you, on the disk platters in a location that the user cannot access. However, an attacker can open the drive and read the key directly and thereby decrypt the whole drive.
In the end, a sufficiently motivated attacker cannot be stopped short of arresting and prosecuting them when it comes to physical security. Or dragging them out and shooting them...twice for good measure.