These systems are usually windows machines - typically "hardened" to various degrees (lock out USB keys etc) and protected by enterprise anti-virus solutions (mcafee, etc)
The windows build is typically a single "golden image" with a known checksum that can be blasted down to machines over wan/lan during the evening.
Source: I used build and deploy the image to many thousands of POS systems at Dixons Store Groups retail chains (UK)
Good stuff!