Group policy to lock out inactive users does not always work. The following is an alternative approach that might be appropriate (http://www.bridgetonova.com/2007/11/how-to-lock-computers-when-idle-by-using-gpo.html)

• Logon the domain controller and then run 'GRoup Policy Management'
• Create a new GPO item and call it "Lock When Idle"
• Associate this to the required users
• Edit the group policy and navigate to "User Configuration|PReferences|Control Panel|Settings|Scheduled Tasks"
• In here create a new scheduled task called 'Lock When Idle'
• Update the task as follows:
  • Task tab
    • Action: Update
    • Run: rundll32.exe
    • Arguments: user32.dll, LockWorkStation
    • Scheduled tab
    • Scheduled Task: When idle
    • Start Time: blank
    • When computer has been idle for: 15 minutes
  • Settings tab
    • Uncheck everything
  • Common tab
    • Uncheck everything