We're a small college, where every student is assigned an Active Directory account. We have a couple computer labs where the machines are all joined to the domain and students can log in to any machine. Over the course of a semester, most students will log in to most machines.
In the past, under Windows XP, we have managed this using the old Copy Profile functionality, along with a product called Deep Freeze, such that profiles are effectively cleaned up automatically. A lot of schools have used this technique successfully for a long time.
Unfortunately, Windows 7 breaks all this. We can no longer use the Copy Profile feature to prepare template profiles for the workstations. Group Policy could work for setting up the machines, and this is the official method for handling the problem. Unfortunately, this doesn't work as well, for two reasons. The first is that Group Policy is no where near as friendly for setting up the profile tweaks. We can't move as quickly on changes we want to make, and some things can only be done to the machine before running sysprep (which would require more frequent re-imaging of the entire OS). The result is that we end up with a less-polished desktop experience.
We could bite the bullet on the that first issue, but the second issue is that all the group policy settings result in incredibly slow login times when used in conjunction with Deep Freeze, because you have to re-apply nearly all the GP tweaks with every login. Windows 7's improved security features over XP (namely UAC) allow me to feel comfortable trying a semester without Deep Freeze... except that we'd still end up with hundreds of user profile accounts on each machine by the end of each semester, and that's after putting in more work to get group policy set up to produce a diminished result.
So are there any suggestions for better ways to approach this problem?
We want to do things like map the documents libraries to network shares, set a default wallpaper, add specific shortcuts to the bookmarks toolbars in IE and Safari (we deploy safari because we have a 1:1 iPod Touch program and need iTunes as well), and lots of other tweaks to these public workstations. We want to be able to do it quickly, where we can get good feedback on the results of a change, and we need to do it so that hundreds of users can log in with their Active Directory credentials. We've gone down the roaming profile path in the past, and that's not really a good option either.
Currently our domain controllers are still running Server 2003, and we'd also much rather use CloneZilla than sysprep to handling imaging the machines.
I'm also reluctant to use group policy simply as a matter of workflow. When we could use template profiles, if you found something you wanted to change you just logged in as the correct user, changed it, log out, and the change would be applied the next time we updated the machines. Now we have to hunt down the right GP setting, if it even exists. It could take more than hour to complete what used to be a five minute thing.