When a computer makes a NetServerEnum call it sends the call to a browser server. If this is the first the call made by the computer, it must first determine the browsers in its workgroup or domain. This datagram is in the form of a Get Backup List Request datagram sent to the special NetBIOS <1d> name that the master browser has registered. This request is processed by the master browser for the client?s domain and subnetwork. The master browser then returns a list of browsers active in the workgroup or domain being queried. The computer selects the name of three browsers from the list, and then stores these names for future use. The computer randomly chooses a browser from one of the three browser names and calls NetServerEnum, requesting a list of servers or domains. The browser server returns the list to the client, which then can be displayed in Network Neighborhood. This all works fine for computers in the same non-routed network.
Much of the Browser Interaction on a network is broadcast traffic. Since TCP/IP broadcast are not routed Each TCP/IP network seperated by routers counts as a single network. Your network description sounds like you have routing taking place via your VPN, which is why you can ping.
Even if the workgroup name in the remote site is the same as the HQ site it is treated as a seperate workgroup. It sounds like you need to establish a PDC in the HQ site to cordinate the browse list of all network master browsers
