How about a distress code password that you can give them which when used triggers a self-destruct mechanism.
I suppose they image it, use the password on the actual machine, and if something goes wrong or self-destructs, they'll always have the image (it just takes a little more time to convince Windows to load).