My client does not know whether or not his copy of server 2003 is a legit copy.

How can I check this without compromising his setup and company files?

If it's not legit, he is willing to purchase a license.

He has ten machines (XP pro) connected to the server for file sharing.