It always seems that I have more questions to ask. But they help to make a more informed decision.
1. What OS are the PC's running?
2. Do you need to access the remote computers without user intervention?
3. Do the remote computers attach to the main office network at this time?
4. If so how is that accomplished?
5. What is the perimeter device being used at the main office? Reason for asking as it may have VPN server capabilities already.
With regards to hardware versus software, there are a few questions that need to be answered as well.
1. Do these remote sites need to be accessed only at the actual site or are they mobile?
2. If not mobile now, are there any plans to have them become mobile?
3. Are there any plans to have the remote sites access the main office network for reasons other than remote control?
It may help to describe what I would consider an optimal situation. I also assume that the remote sites are mobile as well, which is the worst case scenario when you consider complexity.
I would set up a hardware VPN server at the main site with hardware VPN client devices at the two remote sites. That way you can have complete access and control over the remote computers. It also gives you two options as to how the remote sites access the Internet.
1. The remote sites are just a secure extension of your network and they access the Internet through your perimeter devices.
2. If bandwidth at the main office is an issue then you can have what is called a split VPN, where by the remote sites access the Internet through their perimeter device and main office network access is through the VPN tunnel.
If the remote site computers are using Windows XP pro that is all you need to do as you then can use Remote Desktop/Administration to access the computers over the VPN. It also allows you to use NetMeeting if you want to trouble shoot the remote computer with the user on line.
I mentioned earlier that the remote computers were mobile and that introduces security concerns that are addressed nicely by using VPN access. The mobile computers would use a software VPN client as this allows secure access from non-secure Internet access points such as hotspots and hotels. Once the VPN tunnel is setup the remote/mobile user gains Internet access through your perimeter device and has an encrypted link to your network.
As for what devices to use that requires knowing your budget, bandwidth requirements and possible growth. I shy away from consumer grade equipment. Most business class routers have VPN capabilities, CheckPoint is one that I would more than likely use for this situation as they have a small VPN client device with an intuitive GUI user interface that would work quite well for this situation. You also will never go wrong with Cisco ASA or Pix firewall devices either, but they are more expensive than most devices. Finally if you have financial constraints, I would suggest looking at the NetGear business class devices