In BIOS disable boot from CD/DVD, USB, & Floppy. Put a password on the BIOS. Set a very strong password on the administrator account (14 characters minimum mixed case with special characters). While logged on as administrator disable all network adapters. Place his account in the users group only. Then watch him like a hawk.