both pre and post do indeed run under "nt authority\system". when i change the credentials of the tools service to the local administrator, pre runs under local administrator and post still runs under system.
executing my msdtc install in the pre under the administrator credential does not help (which surprises me).
i've noticed that now with the tools service running under administrator, the logging to the customize-guest file is now split between 2 files, one in the C:\windows\Temp directory i have been seeing and one in C:\Users\Administrator\AppData\Local\Temp, seemingly split between the pre and post customization stuff. not that that really matters.
i have a few other ideas i am working on trying with some other powershell tricks. any further suggestions would be great.