At some place I worked there was a policy that a small prank was allowed if the workstation was not locked when someone left. I'd almost recommend that policy for some places.

Acceptable pranks would be things like:

- innocent videos (annoying videos for toddlers etc)

- change Spotify playlist from rock to childrens songs or rickroll or something

- open MS Paint and draw something (those pranks weren't necessarily small, we got three huge monitors side by side on those workstations)

- etc

Unacceptable pranks:

- anything that wasn't possible to revert in a hurry

- anything a customer couldn't see (we were on display :-/ )

At another place I know someone sent a mail to the team from someone elses account that they would bring cake the next day.

I once burned myself by doing what I thought was the obvious thing: leaving a message in a text editor and locking the machine. Turns out for some reason he couldn't unlock it after it had been locked that way and he needed to leave the campus to have IT at the main site unlock it. (When he locked it he always did it by closing the lid instead of through the system menu.)