Depending on what sort of threats your client is worried about, there are different things you will want to test.
If they're worried about end-users obtaining or abusing unauthorized elevated privileges on the machine, you should look for ways to obtain or modify the Administrator password on the system. The easiest ways to do this generally involve booting the system from alternative media.
- First, try simply inserting a bootable CD or USB drive and see if it loads.
- If that doesn't work, try accessing the system's boot menu (if it has one) to force selection of the boot media.
- If that doesn't work, try accessing the BIOS to change the default boot order yourself. Also, use this opportunity to verify that the CD drive(s) and/or USB port(s) are actually enabled - and enable them, if not.
- If the BIOS configuration or boot order is password-protected, there's probably a way to reset this via a jumper on the motherboard. Look that up and try it.
- Once you've loaded the system with your own boot disc/drive, see if you can read the HDD. If you can, you should be able to discover or change the passwords on any local account (including the built-in Administrator) with the right tools. After that, the system is effectively pwned.
Alternative methods of privilege escalation involve client-side exploits. You may want to try this if you can't boot to alternate media, or cannot read the HDD after an alternate media boot, or if you'd like to cover this territory in addition to those tests. To check for these, you will at minimum want access to a Limited User account on the system. Then, use tools like Metasploit and/or Nessus (and, failing those, Google) to discover and test vulnerabilities you might be able to leverage to upgrade your Limited User's access. Here, you'll also want to check how the system handles AutoPlay/AutoRun functions for removable media.
If the client is more worried about data theft, I'd test the system for susceptibility to network-based exploits just as if you didn't have physical access. Once done with that, you could also just pull the HDD and see what you can read off it from another system.
Regarding defense against physical attack vectors, here's a few other threads you may want to read:
How can I prevent my kids from bypassing my computer restrictions based on Windows Vista?
How can I prevent someone from accessing a Windows XP system via boot disk?