I've seen remote workstation management with Puppet done well, and in all those cases there was a custom wrapper around running Puppet. It was never just "turn on the Puppet daemon and hope for the best".