I'm sure for most, this is incredibly obvious, but for anyone

We've just begun our testing on Windows XP SP2 and of course the
built-in firewall, which is on by default, blocks Zenworks remote

To allow it to work on a target station, the Remote Management Agent
needs to be added to the firewall exception list:

c:\program files\novell\zenworks\RemoteManagement\RMAgent\zen rem32.exe

On the flip side, at the management station, Novell Remote Control
Request Listener (RCListener.exe) will also need to be an allowed
exception, but Windows is kind enough to ask you when you start
ConsoleOne whether it should be blocked or not.

Solves our problem on a per machine basis - as the week plays out,
we'll examine how to set these exceptions by group policy for the
remainder of our organization.