He probably has a https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwiktN-h4oXUAhXmCMAKHbSDDusQFggxMAE&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FDictionary_attack&usg=AFQjCNH2ZzsUzN22ipiPVxeNuWcCaPbzBQ&sig2=tVZkABz80pm9WCJFujp3Rg. Try using your licence plate/number plate or something that isn't a word.
Outside of the OS, as above have said, BIOS password http://passwordsgenerator.net.
Also, hacking any computer is an https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=11&cad=rja&uact=8&ved=0ahUKEwjdv_3s4oXUAhXqCsAKHRArDzoQFghVMAo&url=http%3A%2F%2Fwww.legislation.gov.uk%2Fukpga%2F1990%2F18%2Fcontents&usg=AFQjCNFuuZIKGY2ZIys4QBb-uloUDUFcRQ&sig2=aOlMjo9SIpDeAEoiOaH_Iw, so maybe make him aware of that before he goes bragging around. You may not turn him in, but if the school finds out, they're not gonna put him in the naughty corner.