Configure Windows Server 2008 System Policy without the use of GPO
Microsoft have an article about how to automatically import a customized security template into a computer.
Windows XP Security Guide:
Those steps work on Windows Server 2008! So you can just follow it.
Here are the main steps for your reference:
1. Create a custom template using the MMC Security Templates snap-in, and save it to a folder.
2. Create a new security database associated with the security template you created in step 1, and save it to the same folder.
3. You can put this folder in the $OEM$\$1 on the WDS server, so that this folder can be copied to target machine during the deployment.
4. Use secedit command to import the security configuration. You can add this entry as following into FirstLogonCommands section of an unattended answer file:
Secedit /configure /db <DatabasePath> /cfg <infFilePath>
Please refer to the help document included in the Windows AIK for details on the unattended answer file.