I personally like AD, but you've already said you've decided against it. So...
- VPN Connections to connect them to the office. (Routing and Remote Access/OpenVPN/Cisco AnyConnect/What came with your router/etc.)
- LogMeIn or something similar on the clients.
- You can run WSUS outside of a domain. There are registry keys to help you with that, and they can download their Microsoft updates via the VPN. This will also give you reports on patch compliance. You can push out these keys one of the ways below. (Be careful with the SusClientID and PingID--they cannot be identical on all machines. Also, WinXP takes those keys like a little doll, but you might have to handhold 7 a bit.) Conversely, you could foist an update policy on the clients that involves going directly to Microsoft and have done with it.
Which leaves us with software installs/updates. Money and time spent will be in inverse proportion to each other, in my experience, but your mileage may vary.
- Management software like Altiris Deployment Solution, LANdesk, etc. Pros: Built for this, and they make it a lot more manageable. Your clients do show up in the console when they're connected to the VPN, although the connection can be stinky. Cons: Costs money, although I believe most of them charge by the client.
- Scripts and PSexec, although I've never tested running them over a VPN and you'd probably have trouble finding individual workstations. Pros: Free. Cons: You'd probably have to LogMeIn to a remote machine and run PSexec on the local machines that way.
Which is why Grant is in favor of Active Directory for software installs. Honestly, I was just absurdly happy when a former employer finally got AD and I could finally stop pushing out registry keys via management software.
There are also (very few) places that do remote desktops as a service (Desktone, Molten, Citrix, Amazon has a beta). You might be a candidate for that. It's definitely worth looking into in your case, IMHO.
What I would recommend is:
- Figure out how much it would cost to hook the remote sites into your existing domain, including hardware, software, and someone to manage it.
- Price various software packages (Altiris, LANdesk), including hardware, software, and someone to manage it.
- Price hiring another tech or two.
- Price the various Desktops as a Service providers and see if they look like a good fit.
Hopefully, at that point, something will start to look right to you. Good luck!