We recently upgraded our SEPMs, which are 2012 R2 Standard boxes, from 12.1.4 to 12.1.6. All clients are running 12.1.4 (well, maybe something like >1% still haven't taken the upgrade package).
A system was put in place that I inherited whereby a ticket is generated for our PC Support guys to update/repair any client who is running defs that are out of date by two weeks or more. In an environment of 23k clients it generally adds up to 30 - 35 tickets a day for these clients. The idea is that at two weeks we may be looking at an issue with the client or def corruption.
However our PC Support guys frequently grumble about the false positives. Is two weeks too soon to assume a problem? Does there seem something suspicious about these numbers?