You don't need gpedit to do the work that it does - it's just a simple, easy-to-navigate frontend to the Registry. You can always do it by hand... Win7/Server 2k8R2 Group Policy Reference
As to simple things you can do
- User accounts. Your
account (the admin-level account) should have a good password on it; his
account should be a regular-level account.
Leave UAC enabled, and leave it turned up. If he tries to do anything 'system changing', he'll get a UAC prompt, which will require your password.
- Windows Live Family Safety
. This builds on the Parental Controls feature that was introduced in Vista - it really does work rather well.
- Spybot S&D. Install it, even if only for the Hosts file that it can add to the PC.
Those three things will lock him down fairly well.
If you want to really lock his account down (say, to where he can't even open Control Panel), then there's the Registry keys that are described in the GP reference.Note
: most of what you'll want to edit will be in the HKCU hive, for his account. To do this, you'll need to either do the edits from within his account, or load his account's hive into Regedit from your account - your choice.