The free Microsoft utility Windows SteadyState can be used on Windows XP Professional for Embedded Systems to prevent the
OS from any changes.
It offers a write filter which will redirect all writes to a cache file which can be reset on a reboot. This will generate a fresh system on every boot.
Windows Updates can be installed even when the write protection is on. Additional security policies can be applied on the system using SteadyState.