Another round of syskey. This time fake web pages (for those who can't even tell they're looking at a web page) or a little warning note left on the user's desktop with a number to call.
On Win10 machines, the Repair's Advanced EUFI settings is gone, that's how they prevent boot from USB or CD/DVD.
Handy to have a USB/SATA connector, pull the drive plug it in another unit. cd to windows/system32/config and see if there's a regback dir in there. Check it to see if there's anything there - if not they wiped that too.
If [default, sam, security, software & system] are there, make a TEMP dir in config and backup those files from system32/config to it just in case, then delete them from config.
Copy the files from config/regback back into /config. Put the drive back in and reboot.
You'll probably need to reinstall a few apps like Edge and Weather.
If the files aren't in regback, just copy their user docs,pix &music folder onto your other computer. Go into the USB and remove all partitions, don't format. You'll need to put the drive back in the original machine and do a fresh WIn10 install, it will now boot from USB. Copy their docs. pix, music it's about the best anyone can do.
- don't say I never told ya nuthin....