The settings in Control Administration should be pushed automatically to endpoints. Settings, such as lock on disconnect is off by default, but should be on. Putting that aside, activating it requires a reinstall of the Control tool to all endpoints. This is something that should happen automatically, it's a settings update and shouldn't need a reinstall. Please consider automating this process and/or putting clear text which settings require reinstall and which ones do not.
Customer support service by UserEcho