I've come across a caveat with bare metal OS deployment in that it doesn't appear to complete post imaging steps. Specifically, it will not join to the domain that is specified in the bare metal profile and it does not disable the administrator account when it has finished.
If I "reimage" a device using the same image through IEM console, the process works correctly; You can see the post imaging steps progressing, the unattend.xml being applied and the IEM actions show that the "administrator" account is disabled at the end.
I've used the bare metal component (TPMfOSD) in a standalone situation in the past and have not experienced this behaviour. My guess is that the profile that IEM sends to it may not be correct, Has anyone else come across these issues, and is there a solution?