We're currently still using Forefront Client Security which will shortly be replaced by SCEP. IPSec NAP is being enforced for all (with very few exceptions) clients and servers.
FCS has the advantage of having it's own SHV and since servers lack the Security Center (which is needed for the Windows Security Health Agent) we have FCS SHA's installed on the vast majority of our servers. Using that we're able to enforce NAP on the servers as well.
Since SCEP doesn't have it's own SHV (it uses the Windows Security Health Validator) and FCS along with the FCS SHA will be uninstalled/replaced on our servers, how would we be able to continue enforcing NAP on our servers using SCCM? If at all? How are others handling this? Clients are not a problem since Security Center is available there.
We're currently not and have no short term plan to check for Windows Updates as far as NAP is converned.
Any suggestions, hints would be greatly appreciated.