If you have trouble pushing Sophos from your server to your workstations, consider reading the following article by Sophos:
How to configure the Windows XP/2003 security settings to allow one computer to be administered from another computer

We use GPO with Active Directory to push these settings automatically. While you’re there anyway, don’t forget to Disable the Windows Firewall for Domain Network Profiles and don’t forget to Enable the Remote Registry Service for your clients. Happy hacking!