Yes because the recovery menu won't be accessible than (which is needed to replace the sticky key executable) The settings can be changed with bcdedit: bc

Yes because the recovery menu won't be accessible than (which is needed to replace the sticky key executable) The settings can be changed with bcdedit: bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures Additionally booting from USB/... should be disabled in the BIOS/UEFI options and also access to that should be password secured. Further more because the person has physical access, the computer should be locked away so that the harddrive can't be accessed. Also all cables should be secured so that no sniffer can be plugged in between. This also especially includes the USB ports on the monitor if those are enabled.