Why Terminal server / Citrix used for client security, and can desktop security be achieved w/o a thin client?

Thank you for your interest in my question.  I will make this more understandable.

This law firm has less than 55 users in one flat domain. They have 3 domain controllers, 4 member servers, and from what I can tell from the Citrix Program Neighborhood,  3 application servers with one in failure mode.

They have reported varying complaints of intermittent slowness issues. Sometimes they'll be kicked completely off their Citrix session. The problems do not always affect everyone in the office, it is very random.

Two things are obvious;
There are too many servers for the number of applications running.
The law firm was sold thin client technology ostensibly as the predominant solution to network security.
I don't believe this to be true.

Im looking for a honest, unbiased, comparison between fat/thin clients as it relates to network security, and client access.

What would be the arguments of taking the network back to fat clients?

For instance: The problem I see often with Citrix is that it just adds another layer of complexity. You're already having to manage the (usually fat) clients and servers, and Citrix lays on a whole new tier that must be administered, supported, and troubleshot.

Given the hardware investment they already have made,  Can a desktop virtualization initiative be considered as a replacement for Citrix?

If using thin client hardware I'd say yes, but if your using hardware that is already "fat", then probably not. Visualization is typically about space or power, not really security. If the company already shelled out money for PC's that have HD's, CPU/Mem and video cards, they probably bought a windows license for them too. Dell's typically have a M$ license tatoo'd to their chasis somewhere, so they might be paying for more licenses than they ever needed to, paying for the IBM/DELL/HP "fat" clients and the citrix seat licenses. If the hardware didn't come with licenses, they are "white boxes" of generic parts/chassis then that's better. If they are of decent speed and capabilities, then going back to "fat" might help with slow downs and eliminate single points of failure in most cases.
-rich

I'll give you a few points from a pro-Citrix/thin perspective.  We're 85% Citrix/thin client.  We are moving from a XenApp 4 environment to XenDesktop.  We currently have about 300 virtual desktops running with another 200-250 to go.

1. Security can be enhanced using thin clients.  If users can't store data on their local computer (and this includes prohibiting USB storage) then you don't need to worry about them walking out with information.

2. Fat clients are just more prone to failure and more difficult to manage.  

3. Citrix is another level of complexity, though you have to weigh that against decentralized application management.  With 55 desktops then maybe this isn't as big of a deal for you, though it is still worth considering every time you do an application update.

4. Virtualizing and thin clients reduces power and space consumption.

5. Citrix does desktop virtualization (XenDesktop).  You can kiosk existing fat clients so they boot to a web interface page giving access to virtual desktops.

The usb/cd/dvd local storage I covered above, we found however that most users don't even use usb devices when we catch them exporting data they shouldn't, it's to their Hotmail/gmail/megaupload/rapidshare/yousendit or RDP'ing home...
If you do go to the fat client mode, the kiosk suggestion is a good one, M$ has a free product called SteadyState:http://www.microsoft.com/windows/products/winfamily/sharedaccess/whatis/default.mspx
-rich