I want to deploy operating system images on quite a lot of clients. I know that the images must contain the latest security patches, as well as hotfixes (assuming they are tested and approved for the target environment). They also have to be configured to receive regular updates from a certain distribution point. Moreover, I know (see this Q&A) that the PXE installation must be performed in a contained environment, so that an attacker cannot install rogue devices and services.
Are there other security precautions and/or best practices to follow when preparing and deploying OS images?
PS: Here's some additional information, just in case: The client OS is Microsoft Windows 7 x64. I'm deciding to use tools such as Windows Automated Installation Kit, Microsoft Deployment Toolkit, Windows Deployment Services, and System Center Configuration Manager to prepare, deploy, and manage the OS on the clients.