The kid should have changed the password. Then he could have held the computer hostage as a bargaining chip for a better deal.
That wouldn't work. The domain administrator would have just reset the password and unlocked the account.