Here is what I have. I have it pulling the sdat41XX.exe from a batch file for updates.

:McAfeeUpdate
? "Checking McAfee definition files"
; obtain DAT version on client system
$Result=Readvalue("Hkey_Local_Machine\Software\Network Associates\TVD\Shared Components\VirusScan Engine\4.0.xx","szDatVersion")
$ClientDATVer = (0 + SUBSTR($Result, LEN($Result) - 3, 4))

; obtain approved released DAT version
$Result = ReadProfileString("\\Server\LatestDATs$\config.ini", "VirusScan Engine", "VirusDefinition")
$AppDATVer = (0 + SUBSTR($Result, LEN($Result) - 3, 4))

; determine if SDAT needs to be launched
if $ClientDATVer < $AppDATVer
; DAT version on Client is older than that on the server - Run SDAT
$SDAT = ReadProfileString("\\Server\LatestDATs$\config.ini", "VirusScan Engine", "SDATFileName")
SHELL ("%comspec% /e:1024 /c Start /w \\Server\LatestDATs$\$SDAT /s")
else
; DAT version on Client is the same version or newer than that on the server - Do nothing
endif
".]"

Config.ini:
[VirusScan Engine]
VirusDefinition=4.0.4120
SDATFileName=sdat4120.exe


In my hidden share on the server I have a file called Config.ini and the latest sdat executable. A log is also created when the sdat is run. Hope this helps and takes a load off your mind!