If he can bypass 98 logon password, he can bypass almost anything you do to prevent local access. If you install a 3rd party program set to run on startup, he will go to safe mode or boot DOS, just as he would do to bypass the logon.
Could set a BIOS pass and lock the case physically. The only way to bypass BIOS passwords is to remove the battery. Or you could block internet access at a router, do you have one?