I have no domain. All of My machines are in a workgroup.

So My Users login to the Client with their Novell ID and then they login to the machine with a 'generic' local user login id.

If you ctrl-alt-del and choose to lock the workstation, when the time comes to unlock the workstation, you can choose the 'From' field, that is, you can choose to unlock the machine using the Windows login id (generic) vs being forced to use the Novell ID which would be the user that locked the machine.

Can I configure it so that Only the Novell ID would unlock the machine. or Better that the Windows User cannot unlock the machine. (Ideally the Novell id or an Administrator id on the local computer could unlock the workstation, but not a user)