I am not just talking about lockdowns. How familiar with AD are you? Advanved GPOs and such? Can you, for example, offer support to a mac station from your mac station, which shares his desktop? Can you control what type of cetificates the workstations will accept? Are there millions of options?
You can control pretty much anything. For $1,000 you can get unlimited Remote Desktop. No, nothing like RD in Windows. You get screen sharing including a curtain mode so users don’t see what you’re doing, and a whole lot more. Basically, between OS X and Remote Desktop you get the ability of Windows, SCOM, Norton Ghost, and a whole lot more. I suggest looking at Apple’s web site for the whole list of features for client management, including software and update pushes and client hardware and software monitoring. You can even do net boot with custom images for different groups.