It's probably better to just install an MDM. This lets you do ongoing reporting re: is disk encryption active, how long is the timeout for screen locking, etc. And to remote lock the device.