is your friend on a domain w/ a domain server? if not boot to safe mode, log in as administrator, reset his password. assuming that he can't log in due to an incorrect / lost password. if he is on a domain server then go to the server and reset his password there.