We have implemented a group policy which activates the screen saver and
locks the workstation after 15 minutes on inactivity.

I have found that if I come across a workstation which is locked (and the
user isn't around) I am able to login as a user with supervisor to the
tree root, which logs the current user out. However, if another user who
doesn't have S at the root attempts to login at the lock screen, they get
a message that says only the current user or system administrator can

This is in a school, so we want to give teachers the ability to log users
out, but still prevent students from loggin teachers or other students out.

So, my question is does anyone know the rights required to log a user out?