Windows – User Specific Remote Desktop Connection Settings

The situation you described would only happen if the two users are using the same username or you have hit the maximum concurrent users for the server (however you said there are only 2 people involved and the error you had would not happen till a 3rd person logged on and you don't have terminal services licensing set up).

If you are having the "same username" problem the two ways to fix it are to have the users use separate usernames to log in or to allow a single user to have multiple sessions open.

If you are having the "maximum concurrent users" problem you need to purchase a terminal services license and enable it on the server.

Locking a session (either local or remote) is done using the screen saver settings.
User Configuration > Policies > Administrative Templates > Control Panel > Personalization:
Enable screen saver - Enabled
Force specific screen saver - Enabled
Password protect screen saver - Enabled
Screen saver timeout - Enabled

As far as I remember, you need to configure all four.
Also, this policies apply to Server 2008r2 and Win7 - I think XP has other settings.

As for terminating a session, it exists only for remote sessions.
User Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits:
Set time limit for active but idle Remote Desktop Services sessions - Enabled
Set time limit for disconnected sessions - Enabled
Terminate session when time limits are reached - Enabled

If you want to do the same for local sessions, you'll need to script it.