How should you deal with a nasty colleague who is capable of sabotage?

In terms of technical, first change the password for administrator, and give him a his own user,( you can make his account admin with lesser rights), once he starts using there are system logs, if he messes with the systems.Always use system restore with PC's, and must have 3-2-1 backup system installed.

In terms of non technical issues, you must have all stuff done on paper, give him any warnings and make it a known to other HR managers, through CC email system.

Doing all this will, put you out of complete blame.

Report him and treat him respect obviously he has underlying issues.

assign some work to finish it by himself

Jen, is this based from experience? haha