>you're solution with the screen saver is the same as on the my mainframe example. un can and should lock the "login screen" when leaving the desk, or it will be locked automatically after 15 minutes. same concept.

The more things change, the more they stay the same... < s > I remember those days when you'd get logged off the MF after a short time (quite irritating, too :). The only difference now is that you don't need a whole network re-logging process (where ours takes quite awhile), but just an instant screen-saver, so not nearly as bad :)

All in all, a very good solution, I think. Less passwords (only two at most), and better security...though the one downside is when a user

a) forgets SS password
b) LAN needs to get on the local machine for some reason, and has to get around the SS lockout. They have ways, but requires extra work...
c) how to handle roaming profiles

But that's what the LAN folks are paid for, anyway, I guess...