What web browser is he using?
Chrome, GG, and so have I been using Chrome to replicate the problem, but the settings you mentioned are a kipper rouge unfortunately; the "hidden" option is disabled and the "location" is the C: \User\Download folder - which remains empty when something is saved in System32, exactly as is implied should happen from the fact that if the Chrome "Save As" dialogue is re-opened and pointed at System 32, the recently saved file can be seen - but not via Windows Explorer.
Use IE9 (the other browser on my own computer) and the same observations hold true.
Add what I wrote earlier - that saving to System 32 via Windows Explorer works fine whereas web browsers don't - and it really does seem to be something trying to protect the PC from web nasties. It's not Symantec Endpoint though; temporarily disabling it had no effect.