Allow regular user to unlock screensaver locked computer

We have the problem that in a multiuser environment users either lock their computers, or have the screensaver automatically lock it, and leave the workstation. As a result, nobody else can use that computer. By default, only the current user or an adminstrator can unlock the computer. I would like to allow select users who don't have administrator access to unlock the computer.

Is there a group policy or Windows Security setting that would allow some of my users (i.e. non administators) to unlock a workstation?

So far all I can find is a third party application ( Unlock Administrator http://www.e-motional.com/ULAdmin.htm ) This program seems to do the trick but I obviously would prefer to do this through GP.

Note: I don't want to let just anyone to unlock the computer - I want to be able to select only some users.

Any suggestions?

If your willing to allow them to unlock the computer, is there a reason why you can't bump these "select few" up to admin status?

My AD stuff is a little fuzzy. But couldn't you build a user profile that would have rights to do this stuff, like a superuser account? Another possibility is to give say the supervisor a regular production login and a admin login. This is a viable option, because you can track exactly what that admin login is doing easily. We use this system at work on the helpdesk for level 1 and 2 support. I have a regular login, and an admin login. I do 90% of my work in regular production, but can remote in and do lots of other stuff using my admin account using a "run as admin" program if need be.

When someone has that ability, all it does is log off the previous user. It does not grant them any access.

You need to use a 3rd party solution (That is why it exists) or try one of the other solutions mentioned. Such as making them an administrator or enabling some type of auto-logoff function. I believe MS even has a screen-saver that will do that function.

I knew that was true for my home machines, I wasn't sure if it would be different with a Domain server. (I didn't think it would, but I didn't want to say something and look like an idiot.) When the admin puts in his password, it logs the current user out, then logs into the admin account.

We have toyed with a similar problem for a while.

Our solution was to give the call centre supervisors a second account so a user called USER1234 also has a second account called USER1234a the second account is in a domain group that is a member of the local admin group but also denied access to interactive logons.

The result of this was to enable the users to log people off using the 'admin' account but not allow them to log on with the account and do any damage.