I'm sorry that I offer almost no help with this situation, but I just wanted to let you know that we deployed this SEP 12.1.4013 to over a thousand endpoints running anything from 12.1.2-12.1.3, and about 5% of the installs went horribly wrong. It completely broke the NIC driver requiring Clean Wipe to be run.
So yes, there definitely can be issues but I've had a hard time narrowing down the cause. I'm starting to wonder if it did have to do with a pending restart from Windows update.