In situations like this, your hacker should get an admin account, create or steal an account for the face to use, and let the face log in normally. The hacker's job is to clear a path, making sure that everything is safe for the face to log in, access files, and so on. There's no need to slave anything.