There is a setting in Windows Group Policy which will force lockscreen / locked screensaver after a machine considers itself inactive for a specified amount of time:
This overrides all other related (e.g. screen saver) settings and PC-local settings. It’s located here in group policy:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
and while creating/linking group policy on a server:
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options