i am not sure about remotely enforcing, but here we make all the users with deployed laptops bring them in at least once a month. from there, we plug them into the lan, make sure they receive all the latest sms pushes and patches, as well as the symantec update from our server. we have a 'laptop' farm where we can do this... it is a big box that can hold multiple laptops, each with their own lan port and power connection. we plug them in batches over the weekend.