Forefront Client Security on one server scenario:

The server will host the following components
Management Server:
It includes the FCS console and the MOM console. It is the sever responsible for
managing all functions. Remote consoles connect to this server.
Collection Server
Event and heartbeat data is collected by this server. There is a database associate
with this role. You can choose to install this database on another server if your
network size and event load requires it. Data is intended to only be stored for a
short period.
Collection Database
This role exists if you split the database from the Collection Server.
Reporting Server
It acts as an archive of data that is no longer stored on the Collection Server. It also
has SQL Reporting Services 2005 enabling you to run a set of preset reports or to
develop your own reports. These are all available over a website and reports can be
subscribed to. Again, there’s a database here that can be installed on another server
is your network size and reporting load requires it.
Reporting Database
This role exists if you split the database from the Reporting Server as previously
mentioned.
Distribution Server
This is your WSUS installation. It’s referred to as one server but it could of course be
many servers depending on your WSUS architecture.