Lock Domain Account Automatically

Yes, and you can set the screen saver (control panel --> Display) to lock inactive users until they re-input their password as well.

http://www.jsiinc.com/sube/tip2100/rh2147.htm

There is a setting called "Amount of idle time required before disconnecting session" found in both the local security policy on each computer and in the default domain security policy on your DC. The setting is in number of minutes.
On the local machine, the policy is found under Control Panel / Administrative Tools / Local Security Policy. Within the policy editor, the setting is found under Local Policies / Security Options.
To set this domain-wide, go to Control Panel / Administrative tools. Here, make sure you choose Domain Security Policy (vs. Domain Controller Security Policy or Local Security Policy). In the policy editor, the setting is found under Security Settings / Local Policies / Security Options.
Whether setting it locally or domain-wide, you enable it by checking the box labeled "Define this policy setting" and setting the idle time limit. What this setting actually accomplishes is to lock the machine in the same manner as hitting CTRL-ALT-DEL and choosing "Lock this computer. It still requires the user to hit CTRL-ALT-DEL and enter his user ID and password to regain access.
If your users are using other than Win2K, you may be out of luck without either some 3rd-party software or heavy duty scripting.