How can I set so workstations either lock or log off after a period of inactivity?

In group policy, go to User config->admin templates->control panel->display, and set "screen saver" to enabled, and "password protect the screen saver" which will enable the screen saver for the default timeout, and it will be locked. Also, if you don't want users changing the timeout, set the last option, "Screen saver timeout" to the appropriate number of seconds.

You can also hide the screensaver tab so they can't easily change the timeout period. They could still change it in the registry, but if you configure that timeout in GPO as Phyridean mentioned, it'll automatically change back when the GPO is refreshed.

I think that's exactly what I was looking for, thanks.

No problem. Glad to have helped.