I've got it running on a couple of SBS-2000 servers with ISA 2000 running,
but I've got the box with SBS-2003 sitting on the desk waiting for
scheduling the upgrade time.
It updates via WindowsUpdate or AutoUpdate--those should be getting out
through the firewall, I'd think, unless you are running WSUS? If you are,
in fact running WSUS, you need to approve the new class of signature
updates.