If you have em library installed that will suck down the updates from sophos and keep your central repositry up to date then you can deploy the msi from there.

Must admit it does sound a better solution that having to keep pushing the initial install manually.

Ben