Locking Workstations in NT/2000

[hatboy]

I work as an NT Systems Administrator at a university. We're currently having problems with people locking NT and 2000 machines and leaving them locked for long periods of time. It's annoying to constantly have to go around to all of the machines and unlock them. I'm wondering if there is a way to either make it impossible for users to lock a computer (but only for certain users, ie administrators could still lock machines) or to set a time limit for locking a machine (ie the user would be automatically logged off after a certain amount of time). In searching for a way to do this, I've run across NOLOCKWS. This just disables the lock workstation button for all users. However, this isn't exactly what I'm looking for (I'd like administrators to be able to lock workstations), and it doesn't work in 2000 (I've tried it). I'm fairly certain that what I'm looking for can't be done with policies or registry settings. Does anybody have any suggestions?

 

[kyoshozx]

In windows 2000 you can disable lock the lock computer in group policy. It's Under User configuration/system/logon/logoff. Just enable the policy Disable lock computer.

If you're using Active Directory you can set this in the domain policy if you want to disable ALL users from locking the stations, or just create a new organizational unit and place the users you want in the unit. Then create a new group policy for that organization unit with the disable lock computer policy.

 

[Nucleus111]

The same goes for winNT. Everything is available to you in the policies enabled on your domain controller. If its lab machines on campus thats the problem, then just set up a profile for those accounts or computers and lock em out of whatever you want.