Here is how we had to configure out Instant Clones on v10.3
Deactivate golden image before pushing out.
On the policy communication - "Manager Initiated"
On the System Settings uncheck "Allow Agent-Initiated Activation"
On Event-Based tasks create one to run when a computer is created after 3 minutes - activate agent - apply policy.
Hope this helps.