Endpoint Protection

Whether right or wrong, I have an unmanaged SEP 12 client running on my SEPM 12 server where things have been running just fine.  Found this useful in troubleshooting whenever my SEPM server fails to download virus definitions.  Moving forward, I'll need to set up a new server/VM with SEPM 14 and migrate the existing SEP clients over.  Does anyone know whether it's recommended to install a managed or unmanaged SEP client on the SEPM server and why?  Also, are there suggestions on what SEP options should or shouldn't be installed for the SEP client that's protecting the SEPM server?

As for the OS on my new SEPM 14 server, I secured a Windows 2016 license although my VM sometimes hangs after rebooting from patch installs.  Is anyone else seeing this same behavior?  Like Windows 10, 2016 seems to have issues as well so I'm thinking maybe it's better to go with 2012 R2 instead.  I'd appreciate your thoughts on this.  Thanks in advance!

The server should be protected and all SEP features are fully supported on a server OS. Whether you want managed or unmanaged is up to you. You can easily setup a managed client to be "disabled" for troubleshooting purposes just as an unmanaged client would be. Basically it comes down to visibility and being managed by the SEPM versus not.

Can't say I've seen issues with 2016 and SEP 14 yet. May be try with AV only and add each component back one by one until the issue appears. My first guess would be the SEP firewall or ADC component though.

I'd generally recommend a managed SEP client running on the SEPM.  Other than that nothing further to add on that piece, I believe Brian's comment covered it =) 

Hangs rebooting from patching on Server 2016 are not an expected issue that we've seen a pattern of.  Does it reboot normally at other times, when you haven't applied Windows patches?  If it's related to SEP or SEPM I'd expect the hang could occur on any boot. 
 

Marking this thread as solved by Brian. 

Clint, if you need to pursue the boot hang any further, I'd encourage you to please open a case with Support.  Thanks.