System Center Configuration Manager has a couple excellent tools for this (Operating System Deployment [OSD] and Desired Configuration Manager [DCM]). There is significant administrative overhead in building such a system.
OSD will allow you to do intelligent system imaging. This is very useful as it is fairly simple to maintain once properly built. There are people who's entire professional duties revolve around this so it can get very complex and in depth depending on what you are trying to do.
DCM will allow you to create various Baselines which consist of Configuration Items which further consist of Settings. Each setting can be thought of as something to test on the machine. BY best practice and normal usage it is important that you test the Configuration of something rather than the State of something (i.e. test that a service is not disabled instead of testing that the service is running). DCM is useful in that you can continually add to and refine your Baselines and Config Items and reuse them in other baselines. DCM also evaluates each agent against every assigned baseline on a daily basis by default (can be changed to any interval). A side benefit of DCM is that there are published baselines from Microsoft that help evaluate compliance for various regulations (HIPPA, SOX, PCI, etc). Finally, for resolution of configuration changes, SCCM Collections can be built based on compliance with any DCM Configuration Item, allowing you to build a package that can resolve the DCM Compliance issue in an automatic fashion.