Further, have you really listened to his explanation of why he isn't bothered about locking his computer? It might be that in your organisation this is a cargo

Further, have you really listened to his explanation of why he isn't bothered about locking his computer? It might be that in your organisation this is a cargo-cult security practice that he's not bothered by because he knows it's not an effective practice. Or it could be that he knows he doesn't have enough permissions to do any damage, so he doesn't bother locking his computer. Trusting him with a little responsibility might change that.