Just in case this saves someone else the frustration and time I have spent... if you are configuring a computer with Windows SteadyState to clone using Sysprep and you've locked the profile even once during testing, you are SOL. The Handbook states that the profile must be unlocked, but that's not actually good enough. The Webjunction manual doesn't mention this either.
http://forums.microsoft.com/WindowsToolsandUtilities/ShowPost.aspx?PostID=1984622&SiteID=69