Managing Virtual Macs on a closed network
Apple Remote Desktop turns out to be the answer.  It is important that ARD have a separate administrative user account, and I recommend that the account be hidden from users' view.