It gets better. I think it was actually set to auto lock after a minute or two, but I had practiced the routine on my own computer a few times first and managed to get it down to like ten seconds.

He went to the bathroom right before heading out for lunch. I had my window. I did it quickly, and then joined him for lunch, keeping a straight face the whole time. When we came back I nonchalantly asked about some code for him to review but he was like hold on...

Didn't suspect me until way too late :D

But then after that, every time some random error popped up, he was like... "solardev, what did you do this time!" Fool him once...

I've recently been driving a policy at my workplace that if you find a PC unlocked, you send out an email blast promising donuts (also copying in the victim). The victim then has a choice: admit to a security breach and have to sit through a training session, or follow through with donuts. This incentivises reporting, and disincentivises leaving your computer unlocked through social, economic and experiental means

If someone on my team leaves their PC unlocked I usually start writing a self-incriminating email to cybersecurity on their PC before locking it.