There was an article somewhere, which recommended installing vmware tools on a non-vm OS, just because virus/malicious payloads will detect it, think it's a honeypot vm and shred itself so as not to get discovered. It's a nice way to protect yourself from payloads that may otherwise have executed and be invisible in honeypots.

It better for everyone if honeypots and normal systems looks as similar as possible.