the "password" on 95, 98, and me weren't meant as security features, they were meant so users could have different profiles and desktop settings, icon placement, screen resolution, etc.. that's why you can jsut hit cancel and windows will load up as normal, with the default, or "all users" settings in place.
the best option is a bios password.
not sure how young the little guy is, but simply removing the keyboard, or mouse, or powercord, might not be an option...they can always borrow from a friend
my mom used to take the phone cord to work when i was grounded from the phone. i jsut got a spare cord from a friends house and kept it hidden in my drawer
netnanny, cybersitter, and others like them are all excellant programs to use. this will allow specific settings, content restrictions, and can record keystrokes, programs that were accessed, and a lot of other stuff.