Yes there is an automated way to push the cleint from MR2 to MR4

Migrating to Symantec Endpoint Protection 11.0.4202 (MR4 MP2)

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009051906042048

To migrate client software

1. Log-on to the newly migrated Symantec Endpoint Protection Manager Console if you are not logged on.
2. Click Admin > Install Packages.
3. In the lower-left pane, under Tasks, click Upgrade Groups with Package.
4. In the Welcome to the Upgrade Groups Wizard panel, click Next.
5. In the Select Client Install Package panel, all existing client packages are listed in the drop down box. Select one of the following:
   
   • Symantec Endpoint Protection <appropriate version>.
   • Symantec Network Access Control <appropriate version>.
6. Click Next.
7. In the Specify Groups panel, check one or more groups that contain the client computers to be migrated, then click Next.
8. In the Package Upgrade Settings panel, check Download client from the management server.
9. Click Upgrade Settings.
10. In the Add Client Install Package dialog box, on the General tab, specify whether or not to keep existing client features or specify new ones, then configure a schedule for when to migrate the client computers. Under the Notification tab, if desired, specify a message to display to users during the migration.
    
    • If the clients in the group run a version of Symantec Endpoint Protection previous to MR3, turn off scheduling. Scheduling is on by default when a new client install package is added to a group. If scheduling is turned on, the upgrade fails. To turn off scheduling, in the Add Client Install Package dialog box, uncheck Upgrade Schedule.
11. For details about settings on these tabs, click Help.
12. Click OK.
13. In the Upgrade Groups Wizard dialog box, click Next.
14. In the Upgrade Groups Wizard Complete panel, click Finish.