My manager constantly leaves his computer unlocked. The problem is that he's the IT director, and I'm the IT Systems Administrator, and I leave my computer locked whenever I'm not near it. How can I tell him to please lock his computer? It's not only him, other users also leave their computer unlocked.
Do you have a policy in the company to lock the computers? There should be periodically mails explaining why people need to lock them. Also, another way of making people to start understanding the problem is that whenever you leave the computer unlocked, someone else changes the wallpaper/screensaver. It won't harm and will make people start thinking about all the possible things that could happen if someone with bad intentions had access so easily.
I disagree with the answers suggesting changing people's backgrounds / messing with emails / stealing mice. That sort of "pranking" is a snarky passive-aggressive part of "office culture" I can do without.
Thankfully it doesn't exist at my current workplace. Everyone locks their screens because we have a security-focused work culture and published security policies, enforced by technical means where practical.
If you don't even have an official security policy yet, work on that! You can worry about enforcing it once it's actually defined.
Make the lock automatic
Windows has a setting to lock the workstation after x minutes of inactivitiy ...
That way, you might not need to educate anyone.
Make locking easier
By educating users about the keyboard shortcut to lock their workstation (on windows, that would be WINDOWS + L, where WINDOWS is the key with the windows icon).
Make them aware of why locking is important
By explaining the actual harm that could arise from not locking the workstation.
In my company we have this "game", where we open their Slack, Microsoft Teams, mail or whatever group message app we use and invite on their behalf for breakfast next day.
It might seem stupid but since management supports this action, it has increased awareness towards the importance of keeping your computer locked. Plus you get food for free
Also you have the legendary extension of (Nicolas Cage), beautiful
edit: as Sourav Ghosh said on comments, this action is highly dependant on the expected reaction of the person
As we can see that the problem is for more than one person, it'll not be useful to chase every individual and try to enlighten them individually.
Rather, as a first attempt, use a mailer list (e-mail distribution alias) to send e-mails about the problems and security issues that can arise due to leaving the workstation / laptop unlocked while being away from desk.
This is something that should be enforced / practiced  on a organization-wide level. Two suggested steps:
If you know this causes legal problem / breach of company policy / CoC etc. - take this up to your superior / manager (don't point out anyone, just mentioned you have noticed this "behavior" or "trend") and ask them to issue an official notice (rather than an informational email) to enforce the rule of locking the workstation.
If you feel this is something of a "best practice" level, send the informational mailer / ask to have InfoSec sessions / training for employees.
Note: This answer does not take into account the fact whether the auto-lock (lock the PC after inactivity of X amount of time) is enforced or not, as the question is about to educate the employees to not to wait for and rely on the auto-lock, rather manually lock the system before stepping away.
 : based on applicability.
After the edit:
We don’t have a company IT policy yet.
High time to get one setup and roll out. It gives you and the IT / InfoSec team a background and other employees a reference to follow.
You can't "enforce" anything on your manager - you don't have the authority.
What you can do is to go through the proper channels and propose good security policies.
You could always draft a proposed policy yourself (using whatever format your company uses for policies) and submit it for discussion/ decisions through whatever process your company uses.
The other tactic is the "question" or "I wonder" tactic - "ask" in various ways if there is a company policy on this. "I wonder if our company has a policy on employees locking their workstations when walking away? If not, I wonder if that would be a good idea?"
Is approaching him required? Could you leave a friendly anonymous note on his keyboard?
I worked in a place where if anyone from the IT department saw an unlocked computer and the user was nowhere in sight they left a post-it note saying:
You left your computer unlocked so I locked it for you!
You're welcome! Please lock your computer when you leave your desk in the future.
It usually had the desired effect.
The answer to this highly depends on many factors....
The country this is happening in can be important. In the UK it is a breach of GDPR to leave the computer unlocked if the person is able to access someone else's data from it.
If it is a legal problem and you are responsible for monitoring this, then send out an email reminding people of the need of locking their screen.
If you are in a relaxed environment, then the best lesson is to simply "Cage" their computer, have them come back to a locked computer with Nic cage in the background. Something funny like that will probably teach them to be more careful.
There are two distinct problems here, I think:
- How to convince your manager to follow the practice
- How to convince the rest of the company
The way I would address it with your manager is to focus on the issue for the rest of the company, and not make it about your manager for now.
Go to your manager, and point out that there is a culture in your company of leaving workstations unattended, which leads to potential liability for the company.
Suggest that it becomes a priority for your company to push out a clear policy on workstation locking, and send out memos to the employees with some of the suggestions from the answers here - mostly, telling them why it's important and what the risks to the company are, and telling them how to do it.
Then, you and your manager should remind people you see with unlocked workstations to lock them. Locking your workstation is a habit - it's one that's easy to get into (windows key + L for a windows machine), and it just takes doing it a dozen times or so. Help people get in that habit, and maybe have a few others help you remind people.
The advantage here, for problem #1, is that it hopefully solves itself - once your manager is on board and reminding other people to lock their workstation, it's easy for them to also get in that habit. And if they fail to get into that habit naturally, well, once you're reminding others it's easy to say 'Hey boss, looks like I got you!'
If you are a security company, it should be easy to make the case for hiring a penetration testing organisation to give your systems the once over. Make sure they include social engineering techniques. The results will probably scare your management so much that you won't have to worry about unlocked computers in the future
In one of my former workplaces we played this game, which I recommend as a deterrent to leaving a laptop unlocked:
If someone's laptop is spotted unlocked, someone sends an email from it to the whole team saying they will bring snacks, cookies, or something like that to the whole team.
People start locking their laptop and if they don't, they pay the price.
Is this an actual problem?
If there is sensitive data on the computers that other co-workers must not access, it should be a company policy that every hire pledges to observe. With appropriate penalties. Push toward introducing such policy if you think it's necessary. This way you appear neutral, not aimed particularly against anyone.
If the company provides enough physical security that locking computers is not required, and there is nothing secret to other employees, laid back policy is a tangible boon. Taking it away from employees is outside of your competences.
Locking just for the sake of locking is pointless. Sure, it does train a good habit. But the habit is still of no real use. Employees will benefit from it only if they switch jobs. You don't want to train people for their next job.
BTW: You sound "I'm doing X, so others must do same". Be careful to never phrase anything this way. Make your argument about X, never about you (nor other people).