Oh, and stopping should also be done when locking the machine. The way our old local agent handled idle time (that is both "machine got locked" and "machine is idle") was that after a certain grace period (i think 10min back then) logging back in would trigger a dialog asking you what you want to do with the time since idle. Was it really on the task that was running or was it time off (forgot to stop when going for lunch) or on a different task (forgot to stop/switch) when going into a meeting).
That seemed to work pretty well.
Cheers,
Thorsten