Hacker News new | ask | show | jobs
by AlexeyBrin 3510 days ago
You could limit his user rights, make him a Standard user and don't let him install new software.

Also, have a look at how suitable a Chromebook will be for his workflow (simpler to maintain from your perspective and harder to infect).