When triggered manually, it should preserve the lock state after unlocking.

[xSmurf]

If one uses the CLI to trigger the lockout, then locks and unlocks the screen, deny new usb will be disabled again. Instead it should detect that it's been manually triggered and leave it as-is.