Group policy to lock out inactive users does not always work. The following is an alternative approach that might be appropriate (http://www.bridgetonova.com/2007/11/how-to-lock-computers-when-idle-by-using-gpo.html)
- Logon the domain controller and then run 'GRoup Policy Management'
- Create a new GPO item and call it "Lock When Idle"
- Associate this to the required users
- Edit the group policy and navigate to "User Configuration|PReferences|Control Panel|Settings|Scheduled Tasks"
- In here create a new scheduled task called 'Lock When Idle'
- Update the task as follows:
- Task tab
- Action: Update
- Run: rundll32.exe
- Arguments: user32.dll, LockWorkStation
- Scheduled tab
- Scheduled Task: When idle
- Start Time: blank
- When computer has been idle for: 15 minutes
- Settings tab
- Uncheck everything
- Common tab
- Uncheck everything
- Task tab