To go a few steps farther, make the screensaver automatically lock the computer and go into your security policies and change the settings so the last username isn't displayed in the login screen after a restart. That way he won't even know what the new admin account username you've set is unless you leave it locked with that username.