Whatever solution you decide upon, you should also discuss with the manager, supervisor of the helpdesk to see how much traffic they are dealing with now, what any change to a standard or policy would be, and even check to see what ideas they may have for account disable/lockout.

With that many workstations, or even more, disabling accounts and having the users calling in and going on tyriads probably would not work; time-based lockouts may work better, but again you may wish to discuss with the help desk as well.