sounds like your son is more tech-savvy than you ... not a good position to be in.
you have various options, ranging from simple to relatively complicated (also varying in effectiveness). before we begin, pls note that there are several reasons you should be slightly alarmed at the easy access yoru son has to your system. whether the ubuntu CD corrupts your system or not (i suspect it won't, but ya never know), if he is able to get admin access, he can then boot the machine, log in as administrator, & do whatever the hell he wants (eg, install questionable software). he might even install malware (by accident or otherwise), due to curiosity, desire to retain admin rights (i.e., backdoor of some sort), or some other motivation.
the "best" solution really depends on a lot of factors, so to maintain brevity, I'll give the "best" answer from a comprehensive standpoint: use FDE software like BitLocker, TrueCrypt, or whatever, to encrypt entire disk, requiring authentication to boot. If BitLocker, enable TPM in BIOS. Set primary HDD as first device in boot sequence. Password protect BIOS.
the advantage of above is it protects more than just your son running circles around you from a security standpoint. It also protects all your data in the event your machine is stolen (a nice bonus).
talk to your son & advise him that he betrayed your trust. then, create a non-admin account for him to use, and give him a second chance. see what you did there? you've told him that his behavior was bad, but then entrusted him your machine to use responsibly, making him a stakeholder in the security of your machine (as he presumably won't want to betray your trust a second time). the good thing is the account is limited, acting as a sandbox of other user accounts, the operating system files, etc. (note: only do this if this is your machine, not your employer's). if done properly, this won't discourage his curiosity, will make him more responsible, making it a "win-win" scenario.
that's my advice ... but use your best judgment.