I used keep my myriad windows templates in a workgroup but of late I need them to be scanned by various security appliances for vulnerability mgmt. etc. This requires admin accounts to be created on them and becomes and admin pain. As such, I have been looking at joining them to my domain and assign a single account to do these scans etc. I'd never really looked at it in detail but I cannot see any issue sin doing this. I script the power on of the machines once a month for patching and scanning so being part of the domain makes this stuff easier. Also, when deployed, MS SYSPREP runs under the local SYSTEM account and will remove the new machine from the domain and generalize it but not affect the template computer account it seems (from testing). The only bits that required cleanup on the deployed VM are things like local accounts and domain user profiles as these don't appear to be removed during sysprep.
So, wondering what others are doing in this area and anything else to look out for?