Am looking at Puppet and Cfengine. Unfortunately neither can do Windows deployments.
Can you suggest some alternatives?
Some crazy person is trying to port Puppet to Windows, I believe, but apart from that you're basically stuffed -- some of the proprietary stuff says it can manage both Windows and Linux from a single point, but I've never found one that I didn't want to thermite the install CDs of. The systems are so different that you're best off just using the best available system for Linux, and finding something passable for Windows. A single tool is almost certainly going to be a massive and painful compromise that will be nobody's friend.
Have you considered Group Policy Objects (http://www.microsoft.com/windowsserver2003/techinfo/overview/gpintro.mspx)?
You can look at them as rules for the domain member computers and users. Like the config management software that you mentioned, they're centrally administered using AD, and though you can't do version control on them (that I know of), they might do what you're looking for.
If you want to go with a commercial solution (and one that's not cheap), HP's Server Automation platform does exactly what you're describing.
For the free/open-source/cheap route, see my question here: FLOSS Server management and audit tools
Cfengine 3 comes in two flavours: a community version (fully open source) and a "commercial open source" version, Cfengine Nova, which does come with a Windows native service of Cfengine (see supported OS).
I've had the chance to play with this version a bit, and it's rather impressive. Using the same configuration "language" as for *NIX configuration, it can handle all the same things, and more, like editing registry keys.
cfengine actually works for windows. See here a detailed report: http://novosial.org/cfengine/windows/
is it worth it? That's another question