Android Device Manager set password request valid for how long?

[AC Question]

After my phone was stolen (no display lock), I found many strange apps & games appearing in my Google Play App list which I did not D/L. So first I removed all these apps from my list.
Next I used And-Dev-Mgr to set a password & also noted the last time the device was on line was 5 Apr-15.

However, on 7 Apr I still found a new app which I didn't D/L. And-Dev-Mgr reports the device was last on line 5 Apr-15.
So does it mean the phone is not locked yet?

After setting the password on And-Dev-Mgr, I believe the phone will only be locked the next time it goes online. However, I'm not sure how long will this set password request remain active?

I specifically want to lock the phone, not erase all the data.

 

[cpaight]

It should remain active until the phone is powered back on and then remain in effect until it's unlocked with that new password.