Here is how we had to configure out Instant Clones on v10.3

Deactivate golden image before pushing out.

On the policy communication - "Manager Initiated"

On the System Settings uncheck "Allow Agent-Initiated Activation"

On Event-Based tasks create one to run when a computer is created after 3 minutes - activate agent - apply policy.

Hope this helps.