Locking a session (either local or remote) is done using the screen saver settings. User Configuration > Policies > Administrative Templates > Control Panel > Personalization: Enable screen saver - Enabled Force specific screen saver - Enabled Password protect screen saver - Enabled Screen saver timeout - Enabled
A maioria desses GPs também deve impedir que a configuração seja alterada localmente.