All my users use a Mandatory Profile, with a logoff screensaver set for 20 minutes.

This seems to do the trick.