Can you set the "Deny logon locally" rule remotely

Further to a post a couple of weeks ago I'm looking at an alternative solution for something. We have around 6000 tills running Windows Embedded POSReady 2009 (essentially XP). They are not members of AD so I can't achieve what I want using GPO. I need to create a new user that only has access to 1 folder and cannot logon to the device locally. I know I can add the user using "net user add" and can set the permissions using xcacls (admittedly no idea how to do it at the moment but research will help), however can't see any way of denying the logon. Any help would be useful. Needs to be done remotley so can't just use secpol.msc

 

OK way above my head but thinking outside the box for a moment...

Any issue with just not supplying the user with his password?