The ONLY truly secure system is one that has a CMOS (bootup) password that is required BEFORE Windows will start to load.
Add that in to direct adult supervision ANY time the kid is on the computer and you will be fully secure.
Note to wise, if you forget your CMOS bootup password, you will have to take the easy child into the shop to have it reset.
