After I locked my console (ctl-alt-del enter), user can still swith user then log on to my computer as a different user. So my hard drive still pretty much exposed. How can I prevent this? Like in Windows 2003, only administrator or the user who locked the computer can unlock console.

are you in a domian then other who have the same permission can log on ( using OU security may help), if your computer is not in a domain, what other users do you have on your computer (in users) Understand that phyical assess to any computer Is a easy way to get to you drive.

Yes. I am in a domain. I know I can go to "local security policy" to remove other user from "Allow logon locally." But I like Windows 2003 better because when you lock console, you don't want other user except you and admin to be able to do anything on that computer (locally).