umass_med has probably the best solution. Then it can also be spread out and not all happen during login or shutdown, which can be a pain anyway if MS updates are applying, etc.
I'd rather use the script to get SEP there, then the management deal with "version updates" in the console, which can happen during hours you choose!
You can also have your scripts create a custom registry key at install, like I do here - our images have a key that shows what version of our key software is in that image. So I can literally see what version the image was, when the image was created, who created it, what software is on it, what VERSIONS it started with, and even update those keys when software is installed or updated.
You can even place a file in a certain folder that the install script could look for - if exist c:\work\sep-11.2.1.2 then and so on.