is this a domain account.
if it is. check to see if he is not a
member of any restricted domain group.