First setup the initial profile that you want everyone to have. Do this by getting a computer setup just how you want them to start out. Then copy the profile to a network location, name it accordingly. Only give yourself access to this profile.Next, create a 'Profile' share. Give authenticated users access to it. Create a separate copy of your original profile for each roaming profile you want to create, giving only the person with the corresponding roaming profile access.
Last, use User Manager/Users and Computers to map the user profile to their copy of your original.
They will start with a copy of what you want them to have. As they make changes, they will only effect themselves.
-If your in a WAN environment, you should consider redirecting some of their personal folders.