The lock icon means they are not licensed. The way Avast! works is that it scans your network (or LDAP/AD) for computer accounts and assigns licenses to everything it finds, even if you don't actually install the client on a device. If a device gets added to the console after your license count has been met, it gets a lock icon and will not be licensed.
I was able to email the edu@avast.com and get a new license with approximately 200% of the computers I would actually need because we have a bunch of macbooks joined to our AD, as well as servers and stagnant computer accounts and I was running into this issue.