with physical access to a machine that is not subjected to basic
security its easy enough. if you have the knowledge.

you can password protect bios and not have booting from other media
enabled as well as having the recovery mode password protected but if
you are prone to forgetting passwords....

maybe biometrics?