Normally, with the 'Automatically update clients' option checked in the Control Panel applet (Control Panel>Altiris Deployment Server>Transport tab), after installing a new version of GSS the Dagents will automatically update.  It has been found that with an upgrade from DS 6.9 SP6 or GSS 3.0 to GSS 3.1 or GSS 3.1 MP1 the Dagent will not automatically be updated.

The option to do so is checked; as well as the job itself to upgrade the Dagent is scheduled on machines, but the job is not running.

You will not receive an error in the console however you will see the update agent job scheduled but not running.

From testing, it has been determined that the "Encrypt session communication with Deployment Server" option is checked on the Dagent side. The option to allow encrypted sessions on the GSS server side under the Control Panel applet is uncheck or checked.  In either way you may still see this.

Currently, there is not a direct fix for this issue.  Development is aware of the issue and is working towards a resolution.

As a work around, you can disable the 'Encrypt session' on the client side, restart the Dagent service, and then reschedule the Dagent update job and it will upgrade.

If the work around above doesn't work, you can go into the registry and make the change there and then restart the Dagent service.

To do this, run regedit.exe as administrator

Drill down to HKEY_LOCAL_MACHINE\Software\Altiris\Client Service and locate the 'EncryptSessions' key.  Change this value to 0 (zero) and then restart the Dagent service. 

It's possible to create a .reg file with this change in it. You can then script the running of the .reg file and then calling the SC command to restart the Dagent service.  You can use this within a login script or with some other delivery mechanism. Additionally see:
How to update a registry key value remotely