Installing service packs and hot fixes on an Exchange 2007 server with Forefront Security for Exchange is a routine task that administrators should do, below are the information for how to install it:

1. Stop all Exchange-related services. Also, stop any Forefront Security for Exchange Server-related services that may be running after Exchange has stopped.
2. Run the FSCUtility tool to disconnect Forefront Security for Exchange Server from Exchange. To do this, follow these steps:
   1. Start a command prompt, and then change the directory to that of the Forefront Security for Exchange Server installation.
   2. Type the following command, and then press ENTER: FSCUtility /disable
3. Install the service pack or the hotfix.
4. Start the Exchange-related services, and then verify that all the Exchange-related services are running.
5. Stop all the Exchange-related services.
6. Run the FSCUtility tool to connect Forefront Security for Exchange Server to Exchange. To do this, follow these steps:
   1. Start a command prompt, and then change the directory to that of the Forefront Security for Exchange Server installation.
   2. Type the following command, and then press ENTER: FSCUtility /enable
7. Start the Exchange-related services.

This is part 2 of the very interesting article about the changes in ESE in Exchange 2007 SP1. Highly recommended for reading,

http://msexchangeteam.com/archive/2007/12/06/447695.aspx