Im not sure what first reply, but it went along to line of verifying infrastructure and how DHCP scopes/lease times/replication, AD sites/zones, DNS registration/replication all impact how well instant clones work. Try to simplify as much as possible, we use a dedicated AD site and large VLAN for provisioning, specify the AD site/DCs for provisioning and use those same for primary DNS etc.. Ive had wonky DCs cause issues with sysvol repl and or slow or no GPO application.
We also do not have domain joined golden images, but we have found as best practice to make the first deployment to a dedicated image deploy farm higher in the OU structure that the rest of your farms. Then set a post sync customization script to reboot after provisioning.
the only other policy issues we have had is with DEM occasionally crashing GPP processing at which point there is no fix without a system reboot/recover.
