DLP Endpoint Agent install on new endpoint machines

For brand new endpoint machines that require the DLP agent software installed, is it better to have those machines join the domain and get a valid machine name, and then push the DLP agent package out? That is, don't install DLP agent software into the base image prior to putting those machines out in the network...

My guess is "yes" considering the problems created if the same key is used, an agent registers against the Endpoint Server with one hostname and later another, etc.

Thoughts?