This message was deleted.

True dat. Although we tend to boot masters regularly enough to patch but yeah.

I once had a client that did everything with AppSense , GPO settings and everything. No Group Policy at all. It was with PVS too so horrid to work with. Multiple reboots to apply changes, multiple reboots to revert.

I know others who have done that by accident. Didn't block GPO inheritance, and then sealed the image with virtually every policy applied. That's one of the benefits of App Layering out of the box, IMO. I never have to worry about this until I publish the image, and the only reason I have to crack it open again before it's 'done' is because of Trend Micro.

Depending on GPO settings/hierarchy it can be desirable to have certain settings ‘pre-loaded’ and baked in the images.

No doubt. That wasn't the intention for these people, though. D'oh.