I'm probably the least savvy person who attempts to help on these threads so this is very likely not possible but, if you made yourself the administrator on his machine could you make his AV and/or firewall only changeable by you?
Sorry if it's not possible but my son did something that used to tell me off if I tried to change some settings on my computer when he didn't trust me not to fiddle.
A couple of slaps around his knee caps and he changed the settings. Now he just sighs a lot when he sees what I get up to.
