April 2015 update for Lync Room System provides System Center Endpoint Protection and anti-malware support

Enable SCEP in Internet-connected LRS

To enable SCEP on an Internet-connected LRS, follow these steps after you apply the April 2015 LRS update (15.13.2 update or later versions):

1. Enter LRS Administrator (admin) mode as a system administrator.
2. Click the System Settings tab, and then locate the System Center Endpoint Protection antivirus protection on/off switch.
3. Toggle the switch to the "on" position. Then, LRS will prompt the system administrator with an End User License Agreement (EULA).
4. Accept EULA terms, and then click Apply & Restart. Then, SCEP protection is enabled. 

In basically the same way, SCEP protection can later be disabled by toggling the switch to the "off" position in LRS admin mode. 

As soon as SCEP is enabled, the daily scan time is set at 2:00 AM. This is by default. The scan time is configurable in the same user interface under the Daily Scan Time drop-down menu. Your Internet-connected LRS device is now fully configured and ready to run SCEP. 

Note The Update Mode selections that are located under the Daily Scan Time control are not functional and should be ignored at the current time.

Enable SCEP in LRS in private network environments

To enable SCEP on LRS devices that are deployed in private network environments without a direct Internet connection, WSUS setup must be performed and configured to handle SCEP signature updates after a system administrator enables SCEP feature that is described earlier.

Note SCEP signature updates that are stored in a UNC file share are not supported for the April 2015 LRS update.

To set WSUS for the LRS SCEP feature, follow these steps:

Note References of "ForeFront Endpoint Protection 2010" (FEP) here refer to the LRS SCEP feature, and they can be thought of interchangeably. 

1. In Windows Server 2008 R2, add roles for WSUS and Web Server (IIS) in Server Manager.
2. Open Server Manager.
3. Locate Roles > Windows Server Update Services > Options.
4. Run WSUS Server Configuration Wizard, and then select the settings that are listed here:
   • Synchronize from Microsoft Update Server
   • Use proxy server when synchronizing. Set appropriate Proxy Server Name and Port Number and then start to connect. 
   • Language: English
   • Products: Click to clear all and then select only Forefront Endpoint Protection 2010 under Forefront. 
   • Classification: Select Definition updates and Updates.
   • Sync Schedule: Sync automatically. Then, begin initial Synchronization and finish.  
5. Locate Roles > Windows Server Update Services > Synchronizations. Then, verify the synchronization is succeeded.
6. Locate Roles > Windows Server Update Services > Update Services > Update. Then, right-click Update and then click New Update View.
7. Select updates that are in a specific classification. Then, click to clear all and select only definition updates.
8. Select update for specific product. Select Any product, and then click to clear all and select only ForeFront Endpoint Protection 2010 under Forefront.
9. Specify a name, such as FEP. A node called FEP will be created under Updates.
10. Double-click the FEPnode. Select Approval -> Any expect declined Status-> Any and refresh.
11. All available FEP updates are displayed. Select all updates, right-click them, and then approve for all the computers.

At this point, the WSUS server is ready to serve up SCEP signature updates to the LRS device. 

Note Make sure that the server that runs IIS is installed on the device where WSUS is installed and is available from anywhere in the network. IIS will show under Server Manager. Then, run http://Server from a browser on any device in the network. Or, make sure C:\inetpub\wwwroot on the server that runs IIS has the "Everyone read" access. This makes sure that all devices can connect to the server that runs IIS.

Important When you set up WSUS, you must only apply FEP (SCEP) signature updates, but not Windows Updates.  Windows Updates are currently managed through the Lync Room System update mechanism and do not require WSUS enablement.  Downloading Windows Updates through WSUS may result in unpredictable behavior on LRS devices. The system administrator should make sure to isolate LRS units in such a way that WSUS is only applying FEP (SCEP) signature updates.  You can do this by explicitly adding LRS devices in separate computer groups in WSUS server and setting the rule to only push FEP (SCEP) signature updates, but not Windows Updates. To do this, follow these steps: 

In Windows Server 2008 R2

1. Locate Roles > Windows Server Update Services > Update Services > Computers > All Computers > Add Computer Group..., and then specify a name for the new computer group, such as LRSGroup.
2. Select all LRS devices, and then right-click to change the membership to join LRSGroup.
3. Locate Roles > Windows Server Update Services > Update Services > Computers > Options > Automatic Approvals, and then create a rule. To do this, follow these steps:
   1. Select When an update is in a specific Product, edit the When an update is in any product property. Click any product. Then, click to clear all, and then select Forefront Endpoint Protection 2010 only.
   2. Click OK. Now you have When an update is in Forefront Endpoint Protection 2010.
   3. Edit the Approve the update for all computers property. Then, click to clear all computers, and then select only the all computers property. Then, click to clear all computers, and then select only the LRSGroup that was created.
   
   Note Make sure that Windows Embedded 7 is not selected when you select products in WSUS. Otherwise, it will cause the unwanted effect of pushing Windows Updates. LRS devices should only receive FEP (SCEP) signature updates.  

After WSUS Server is set up, follow these steps:

1. In LRS, enter admin mode.
2. Under the Web Updates tab, select the WSUS server option, and then specify the WSUS/IIS server name, in our case http://server (replace server by using the name that is used in your private network). 
3. Click Apply & Restart. 

The LRS device will now restart, and then enter meeting mode. SCEP signature updates will be pulled from WSUS server to the LRS device.  SCEP signatures will be updated to the latest version. Additionally, daily scanning will occur at the time that is designated by the system administrator.