He mentioned that people just switch it off and back on again, which would defeat locking the login. It seems that people log in using a centrally managed username/password, but see the files on the system's drive.

Phil, do you know who is using it, can you ask them to not use it? Or maybe put a piece of paper on it with a note asking people to find another computer?