A plugin architecture should be implimented allowing small, self-contained functions to be added and automatically downloaded to machines that are part of the domain. These fragments could add simple individual functions such as the ability to add and delete local user accounts or adding a network account to a local group. It could also be used to collect individual pieces of information.
The plugins should be made up of two components, one for the admin tool and one that is executed on the client systems. The client fragments could be placed on the /Network/Library automount share and therefore would not require a "push" capability.