Knowing where they are stored, won't do him any good, as these files are encrypted. Besides, he would not get that far without his password in the first place.
Use the Administrator UserID/Password combination to get in. Then duplicate the "blocked" user under another name. When you are confident that the new user has all the rights from the old one, delete the old user.