If you have access to SEPM database and IIS, you can use the SEP Content Distribution Monitor tool to get some informations about clients. These infos include clients which are not up-to-date. However, it's necessary to reconfigure the SEPM IIS settings for this. Here is the link:
https://www-secure.symantec.com/connect/downloads/sep-content-distribution-monitor
If you don't have access or the tool doesn't fit your needs, you could search for the content cache files on the clients. By default, every SEP client saves 3 content cache files. The folders for the AV/AS content look like this (since SEP 11 MR2):
%COMMONPROGRAMFILES%\Symantec Shared\VirusDefs\YYYYMMDD.NNN (32-bit)
%COMMONPROGRAMFILES(x86)%\Symantec Shared\VirusDefs\YYYYMMDD.NNN (64-bit)
NNN = content revision number
Your script has to collect the content folder names (YYYYMMDD.NNN) and pick the youngest of the three (if your clients are saving three revisions) for every single SEP client.
Just an idea, I am sure there are more elegant ways (registry?).
See this KB document for content cache directories:
http://www.symantec.com/docs/TECH106034