We do not provide any mechanism to lock phones, the only similar functionality is via EM as you mention but you really don't lock the phone.
You just force the user to use a UDP to change the calling privileges. But any user can still go and press the buttons and play with the phone.
If you need to lock the phones and make sure no one can do absolutely anything with it without unlocking it, look for 3rd party apps.
HTH
java
If this helps, please rate
www.cisco.com/go/pdihelpdesk
HTH
java
if this helps, please rate
