followed tags: 4
followed domains: 0
badges given: 0 of 0
joined: 650 days ago
User configuration->Administrative Templates->System->Run only specified Windows applications
You can use stuff like ShowMyPC and remotely add executables to the list if required.
And I think a good free anti-virus software will help as well, I recommend Security Essentials or Avira Antivirus Personal if it's a "buccaneer" version of Windows. Also make a user account for him without administrator privileges. There's also more esoteric stuff like sandboxie or setting up kiosk mode, but I'm not knowledgeable about them.