Thanks. Of course sysprep can't join the domain from an isolated VLAN, unless I've misunderstood the suggestion. But yes, the customization spec could specify a workgroup with the clone's nic disconnected or isolated in a VLAN. That way sysprep renames the source vm but does not attempt to join the domain. Then I'd reconnect or move the clone's nic and join the domain (manually or with Invoke-VMScript) as a separate step, outside the VMware cloning process and its OS customization routine. Any idea if hot cloning in a domain is generally done this or some other way? Or generally not done?
Some backstory in case this seems like a silly question... In the past I cloned several running VMs without noticing DNS dropouts. So I assumed that the clone's first name change, from the source vm's name to the temporary name, happens while the nic is disconnected. Noticing the DNS dropouts recently, I wondered if some buggy recent version or patch was connecting the clone's nic too early, making that first name change too late, or otherwise causing the dropouts. But that might be wishful thinking; it's also possible that in the past we simply never noticed the source vm DNS dropouts.