Screen Lock Administration from a Windows 2000 domain

[Herb]

I have a Win2K domain controller setup and administering
the domain. On Win2K machines the domain policy says that
the screen saver will engage after 15 minutes of non
activity, and will be password protected. This policy
applies to Win2K machines just fine.

Recently we've added some WinXP-Pro machines. The screen
saver is kicked in per the domain time policy, however
WinXP seems to ignore the requirement for password
protection.

As a side note, if the WinXP operator brings up the
desktop properties, screen saver tab, the domain defined
screen saver is displayed, as well as the time delay and
the "On resume, password protect" box is checked.

Any ideas?

Thanks,

Herb