A locked screen doesn't mean there's not an active session; most people just lock their screen and walk away, they don't usually log out. If the machine is on a

A locked screen doesn't mean there's not an active session; most people just lock their screen and walk away, they don't usually log out. If the machine is on and you have physical port access, you can get into it, past the lock screen, and into an active session with a variety of attacks. Even if you can't get into it, there's always cold boot attacks. And even without these attacks, you can leave the ducky and code to execute the next time the machine is unlocked and a user present.