If it is an internal box, then there should be a server acting as his gateway to the internet. Set up wireshark to monitor the traffic on this box, with a rule set for only his ip address.
Alternatively, if you don't have a central node to watch across, set up ettercap and start an arp poisoning. His machine will silently send traffic to you, which you silently pass on. There will be a performance hit on his end, but you get that with wireshark as well.
If you want to start wireshark silently in the background on his machine, you need to realize that wireshark is natively a GUI application. As Zoredache noted, you may want to use a command line based tool instead. The only option I can come up with is noted here:
Set the display variable to be something other than the primary display. Most likely, an X11 session forwarded over ssh. This option will not be available in windows.