The answer to this may lie in per-system mandatory profiles. If you look in each individual profile directory, you'll find a hidden file called NTUSER.DAT. This file contains all the user-configurable aspects of the profile. To create a mandatory profile, simply rename this file NTUSER.MAN. Make the local changes to the mandatory profile first before copying it, of course.
This was first published in August 2003