I highly (and I can not emphasise this enough) recommend setting up a password protected account for security reasons. Of the online variety. Full admin rights, no password and the internet just dont mix.
Sorry, but your advice is wrong. They're two utterly different things, and there's only one scenario when your advice becomes relevant: If it's a laptop with filesharing services enabled and the user is in the habit of connecting the laptop to very open networks (ie. LANs where untrusted people connect). Otherwise, a computer sitting at home is sitting behind at least one firewall, wouldn't be sharing anything up by default, and by default is set to not allow computers to connect to it with empty passwords.
Even if the computer was being used to connect to untrusted LANs with filesharing services enabled, saying a password is highly recommended is not useful advice. Windows filesharing services are not meant to be used with untrusted networks because they advertise tonnes of information about the machine and the MS services its running and the authentication system AT BEST (assuming non-enterprise, ie. NTLMv2) is very insecure. Windows filesharing services is a very chatty protocol because it's designed with the assumption that it's talking to friends; a password sniffer will use that to its advantage and the PC will already have given out the username and PC name in the clear.
I agree - kinda - with your "full admin rights and the Internet don't mix", but not for any reason related to passwords. User Account Control is enabled by default even for Windows users without passwords, so a user signing in to Windows with a password has the same level of protection wrt UAC as a user without a password. The same process of escalation occurs, and even for the user with a password, the password isn't requested when escalation is requested through UAC.
By all means recommend that users sign in to Windows with an account with only standard user privs and have a separate admin account that doesn't ever get used except when absolutely required (though IMO it's a potentially problematic PITA with regard to the average user), but again, the only point of a Windows password is to deny access to unauthorised users with physical access to the PC, and even then, it's trivial to break through unless significant hardening measures have also been deployed. Even then, any malware worth a damn will have been designed to bypass UAC one way or the other.