In the first instance, check the agent_<machinename>.log on the client machine to make sure that the client tried to execute the task. (A good word to search for is "invoking.") Assuming it tried to run the task, but there was a problem, check the mcscript.log in the same folder to see if there are any errors.
It turns out the McAfee SAE was already installed but the service on the local machine was disabled by GPO. Enabled the service and the 900 or so computers started to appear as being installed as SAE 3.0.
Excellent - glad it was nice and simple