You should use a DAL, but not for the reasons stated :)
You performance problem will probably not be fixed by introducing a layer of indirection (even if it might be desirable for other reasons). You should look into what actually causes the performance problem. Some common problems:
- The n+1 antipattern which causes far to many database queries. E.g. if you fetch a list of 100 items from the database, this should require one query, but if you by mistake make an individual query for each item, you suddenly get 100+ queries, which will kill database performance. You can detect what queries are actually executes via the database profiler.
- Clients hold onto db connections too long, which causes the connection pool to be depleted. Eg. an open SqlConnection is stored in a field rather then closed immediately after use.
The .net framework already include a low-level DAL (classes like System.Data.SqlClient.SqlConnection if you use a SqlServer) which among other things handles connection pooling. This is pretty important for performance, and there is no reason not to use these classes to access the database.
I would guess you already use this layer, and you friend is taking about an additional layer of indirection between the .net data access library and the application logic - perhaps an ORM like the Entity Framework or NHibernate, or a hand rolled equivalent.
This will not help you with performance, security or scalability. It might make the application simpler and more maintainable, but will not solve your immediate problems.
Edit: OK you are talking about a web service layer. And you have desktop app clients connecting to a central database over a local network. So you are talking about turning a two-tier application into a three-tier application. This is not going to help you with performance problems. Rather it will just make it worse due to the overhead of an additional layer. Introducing a middleware layer might have other advantages though. For example you insulate the clients from the database which may improve security. But if you are going in that direction you might consider using a wep application instead, which have the same advantages, and is much easier to deploy and instrument than desktop apps.