Can we produce a VM that is joined to the domain? What are the issues related to this?

Not that I have found.  Because of the SID issues, we would need to uniquely generate each new VM for the students.  If we distribute them on a flash drive, then perhaps we could do this, but the SID needs to be changed with SYSPREP or the built in VMware tool before the machine is joined to the WIN.MIT.EDU domain and assigned to the right container.

I am still waiting for a response from VMware about talking to one of their engineers about best practices in this area, but my guess woudl this would more likely be only an option if we looked at a VDI environment where the VMs are run from a central server and machines are created for each user and run locally as a VM.  This currently has limitations that require network connectivity, which may be acceptable for what we are trying to do.

To lock down the machines, we would have to do that locally, but for students to customize the machines, we would have to given them admin access, so they could unlock it.

I have a request into Richard Edelson for ideas too.