Screen Saver / Secure Display Lock

Has anyone figured out a way to deploy a secure screen lock without joining the WES7 to the domain? Is there another easier solution?  We are piloting some 3290 TCs which are working well but I just encountered this challenge today (not sure why it was just today).  This is in a healthcare environment so we need there to be an easy way for the users to blank the screen and lock it.