Prevent Users From Logging Into the Physical Server’s Active Directory But Allow Workstation Logon

Create a group to encapsulate the users (Local-Admins-Tablets) and add them to this group

Create a sub-OU of the current workstations OU and put the tablets in here (Workstations\Tablets)

Create a GPO (Local-Admins-Tablets-Policy) and link it to the Workstations\Tablets OU

In the GPO, set the following:

• Comp Config - Policies - Windows Settings - Security Settings - Restricted Groups
• Right click, Add Group
• "Administrators", OK
• Members of this Group: myDomain\Local-Admins-Tablets

Reboot the PCs, and done.

Bear in mind that setting Restricted Groups will overwrite the machines existing list of local Administrators. If you have other users/groups in there already, you will need to add them to this policy too. Other examples would be myDomain\Domain Admins etc

EDIT: Oh, and change the filtering on the GPO and add Domain Computers. The easiest way to do this is to use the Group Policy Management MMC snapin (you can get this from the Remote Server Administration Tools from Microsoft)

As already explained, you do not need a domain admin to 'unlock' a computer, the user is only required to be a local administrator.

The best solution i think here is to automatically log out users that are idle for a certain period.
EDIT:

It's not a straight forward GPO and requires a bit of a kludge with modifying the windows screensaver. Here's what you do:

1. Download the Windows Server 2003 Resource Kit Tools
2. Copy the Winexit.scr out of the resource kit to the %systemroot%\system32 directory on each workstation
3. Create a user GPO with the following settings: alt text http://img34.yfrog.com/img34/6015/mwsnap53020091124100617.jpg

- for screensaver executable name use:winexit.scr
- for screen saver time-out specify how log the idle time should be before logging out. This is in seconds.