I've noticed that UFW is not enabled by default in Precise (12.04), so it needs to be enabled, and adjusted, by an hcmc package. Specifically, I'm thinking of locking the machines down so that there is only access from our subnet. Ref's here: http://manpages.ubuntu.com/manpages/precise/en/man8/ufw.8.html

An upstart script, or perhaps a lightdm script, needs to be written so that whenever someone logs in to the machine (a desktop session, not ssh) an admin script is run that kills idle X sessions. I've started work on this and have a script that works, but no elegant trigger that will run it on login. I've tried /etc/pam.d/login and adding pam_exec but it seems to fail silently.

A shutdown script that politely informs active users that the machine will shut down in n minutes. The user should be able to cancel it. I have a working countdown timer and shutdown dialogue invocation but have not tested it in a cron job.

Packages for the next LTS need to be built and tested.