Well, through Group Policy you can force to lock down a workstation via a password protected screensaver, mais pas to log it off. The GPO settings for locking down a workstation via screensaver can be found at:
Administrative templates\control panel\display\password protect le screen saver et screen saver timeout.