The installation of the Symantec Endpoint Protection Manager is divided into two parts. The second part, the server configuration assistant, runs after the MSI installer has completed. The server configuration assistant is not MSI controlled and the MSI policy that is enabled has no influence over this part of the installation. The server configuration assistant cannot be elevated using MSI mechanisms and thus the installation fails.
You must be logged in to Windows as an administrator to install the Symantec Endpoint Protection Manager.