Whatever he gets, it would be smart to set it up tight so it doesn't come down with spyware, viruses or unwanted plethoras of junk the kids downloaded. Set up each user's account as a Limited account and stow all the Admin powers in one password-protected account that
no one uses as their regular daily-driver account. Boom. Computer 1, spyware 0 (unless someone deliberately logs on as Administrator and installs FREE SMILIES FOR YOUR EMAIL!!! or whatever come-on they're using as bait).
Also, scan it with
Microsoft Baseline Security Analyzer to find weaknesses that Windows Update won't identify, make sure it has Automatic Updates set up and its firewall on, and I'd enable Data Execution Prevention
for all software too. Since viruses often get lodged in the System Restore files and can't be removed, or are actually
replaced by Windows if they're deleted, I favor disabling System Restore permanently.
If your friend will have broadband, then a cheap home router would be good to have. A Netgear RP614 would provide a perimeter firewall and also let him block or filter sites, regulate Internet access to just certain hours of the day, and it can be set up to email him reports if filters are blocking stuff and he wants to be informed. Those are about $40-ish.
An ounce of prevention is worth a pound of cure, they say

Hope that helps.