Symantec recently posted a bulletin for Endpoint Protection which may affect Lync Server, Skype for Business Server, and Exchange.  The bulletin can be found here.  If you find your Lync/Skype/Exchange services are not starting after server reboot and you are running Symantec Endpoint Protection earlier than 12.1.6, be advised:

Windows computers hang on startup after installing Symantec Endpoint Protection earlier than 12.1.6

Problem

After you install a version of Symantec Endpoint Protection earlier than 12.1.6, Windows computers sometimes hang on startup. This issue is intermittent, and may not occur every time the computer is started.

Cause

The Symantec Endpoint Protection Auto-Protect component does not properly release its opportunistic lock (oplock) on the VIRSCAN7.DAT file. The default location for this file is C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.4112.4156.105\Data\Definitions\VirusDefs\20150114.001\VIRSCAN7.DAT.

Solution

This issue is fixed in Symantec Endpoint Protection 12.1 Release Update 6 (12.1.6 or 12.1 RU6). For information on obtaining the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection.

You can use one of the following workarounds until you can update to 12.1.6 or later:

• Manually create a folder exception for Symantec Endpoint Protection Virus and Spyware Definitions on affected computers.
  Follow the instructions in the knowledge base article Excluding a file or a folder from scans to create a folder exception for the following folder:
  C:\ProgramData\Symantec\Symantec Endpoint Protection\VersionofSEP\Data\Definitions\VirusDefs
  Where VersionOfSEP is the version of SEP installed. For example, on a computer that runs version 12.1.5 (12.1 RU5), the path to this file would be:
  C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Data\Definitions\VirusDefs
• In the Virus and Spyware Protection policy, disable Rescan when new definitions load.
  1. In the Virus and Spyware Protection policy, under Windows Settings > Protection Technology, click Auto-Protect > Advanced > File Cache.
  2. At the bottom, uncheck Rescan when new definitions load.
• Disable deferred scanning in Auto-Protect by following the steps in the knowledge base article How to disable deferred scanning in Auto-Protect for Symantec Endpoint Protection.