I’m wondering if the “lightly managed” Macs are bound to a macintosh server? If they are, that’s a good start. From there, if you are knowledgeable about Mac OS X Server, you can set up a golden triangle where authentication is performed by Active Directory and centralized configuration management is handled by Open Directory.
I’m reviewing another solution from the software vendor Centrify called DirectControl for Mac OS X. DirectControl looks like a promising solution for adding Macintosh computers to Active Directory infrastructure without having to learn Mac OS X Server or implement a golden triangle. Thanks.