user is able to disable to sepm client from system tray

[Migration User]

Hi,

 

I have upgraded SEPM 12.1.5 RU5 to 12.1.6 RU6. After upgrading to 12.1.6 RU6 users are able to disable SEPM client from their system tray. Refer snapshot attached. Policy is same as it was in SEPM 12.1.5 RU5. In RU5 this option was hide.

[Migration User]

Did you log in as an administrator or as a "normal" user with limited permissions?

There are a lot of settings that can only be changed by a Windows administrator, and in this case the option is enabled if it's allowed by the SEPM settings (e.g., firewall settings). See this article:

How to prevent client features from being disabled by users in the SEP 12.1 client interface

 

[ℬrίαη]

There's plenty of articles available on locking this down:

How to block a user's ability to disable Symantec Endpoint Protection on Clients

http://www.symantec.com/docs/TECH102822

How to lock down Symantec Endpoint Protection 12.1 Client

http://www.symantec.com/docs/TECH167182

How to restrict users from making configuration changes to the Symantec Endpoint Protection client

http://www.symantec.com/docs/TECH102370

How do you lock down SEP client interface so that end users cannot disable components or modify settings

http://www.symantec.com/docs/TECH136678

Securing the Symantec Endpoint Protection (SEP) client user interface and setting

http://www.symantec.com/docs/TECH185903

How to prevent SEP features from being disabled in the client GUI in SEP 12.1

http://www.symantec.com/docs/TECH168990

How to prevent client features from being disabled by users in the SEP 12.1 client interface

http://www.symantec.com/docs/TECH168990