Client Management Suite

(This topic started as something totally different, but was edited so that I could  widen the scope of the question...)

So, I recently started deploying Altiris, but I'm having trouble wrapping my head around software deployment.  I'm hoping some of you pros could help.  I've got a 2,000 user environment seperated over 3 locations.

Here's what I need:
* Detect when software is installed, so that installs dont happen over and over
* Be able to deploy to everyone and/or subsets of machines (using local site servers)
* I'd really like to be able to deploy to user security groups, but apparently that isn't *easily* possible
* Allow helpdesk to deploy "one off" software directly to end users machines

I've looked at Managed Software delivery from the software library or UNC, as well as Quick Delivery, and even Jobs and Tasks.  None of them seem to really fit for me.  I'd like to know what others are doing (espeically over WAN links). 

* Detect when software is installed, so that installs dont happen over and over
- Managed software delivery, provided you have correctly created the rules, and haven't run into any of the known issues with the rules.

* Be able to deploy to everyone and/or subsets of machines (using local site servers)
- This is a core function of Software Management Solution, provided you have setup the site servers, associated them to sites, and replicated packages to them.

* I'd really like to be able to deploy to user security groups, but apparently that isn't *easily* possible
- This is now possible, to a degree in version 7, where it wasn't easily possible in v6. However, there are some caveats, where if a user logs into more than one machine, or with a group\service account, the wrong systems could end up with software. That's why I don't like deploying to users. However, you need to import the groups via Active Directory.

* Allow helpdesk to deploy "one off" software directly to end users machines
- Quick Tasks are the answer.

This is now possible, to a degree in version 7, where it wasn't easily possible in v6. However, there are some caveats, where if a user logs into more than one machine, or with a group\service account, the wrong systems could end up with software. That's why I don't like deploying to users. However, you need to import the groups via Active Directory.

I've got it sorta working, but its a mess.  There is no "wildcard/dynamic" import of security groups.  That means that for each new software deployment group, I have to add that new group into a special AD import task for security groups.  And those groups don't update dynamically from AD, so I have to run the import task pretty regularly.

- Quick Tasks are the answer.

In addition to setting up a Managed Software Delivery, I could setup a quick task as well.  But I don't see an easy way to just deploy to a single computer.  It's all targets and filters, and I REALLY don't want the helpdesk team setting that stuff up.  I just want them to type in a PC name and be done with it.