I like to split the roles into separate VMs. I have a few VMs joined to the domain and I can house all the configs and user profiles on the DC. If I need to blow away a machine for whatever reason I do not need to recreate work. I just create a new VM and then join the domain. All the group policy tweaks apply and I don’t need to manually change settings.