I work for a school and a constant problem is staff leaving themselves logged on at workstations and leaving their sensitive materials exposed to other users and potentially students. I applied GP to lock the workstations via the screen saver but then i have another problem - staff leave shared PCs and the next person who wants to use the system can't unlock it.
I have other tech assistant staff in addition to the Sys Admins that do not and should not have full Administrator rights on the domain. Is there a way to (1) add these users to the Administrators group but somehow limit them from other administrative privileges or (2) somehow give their user accounts the permission to unlock workstations.
The problem as you can imagine is rectified by the tech assistant staff presently by hard-resetting the PC - not ideal.