Is it possible to enforce the "Lock on session end" on all machines?
Yes, it is possible. Just Click Options on main window of TeamViewer, later open Advanced tab and finally find an option "Advanced connections settings with other machines". There is an option "Lock remote machine" that is set to automatic by default. Then just change it to never and you are done. I hope it helps you.
did not work. whay might that be?
sorry.. there was an option right at top-menu in remote window that allowed to lock on exit
You can also set the setting in the advanced options on Always to always lock the remote computer on session end.
This will only apply for sessions started from your device.
If you would like to roll out this setting to all devices in your company, you can do it via the MSI package (only incl. in the Corporate license). An enforcement via the TeamViewer policies is not possible.
I hope this information helps you.
All the best,