AntiVirus and Antispyware Protection does not re-enable itself when Symantec Endpoint Protection is disabled from the tray icon by a user.
File System Auto-Protect is set to re-enable itself after 5 minutes by default (The time frame for the SEP client to re-enable itself can be adjusted by an administrator by policy).
The User right clicks the Systray icon and selects Disable Symantec Endpoint Protection.
After the re-enable time period has expired, the Systray icon still shows SEP as being "disabled".
Opening the client interface shows antivirus/antispywear status as "OFF" in red lettering.
File System Auto-Protect re-enable setting does not affect any other protection functions.
If Email Auto-Protect, Download Insight, Outlook Outo-Protect, etc. are installed; they will remain disabled until manually re-enabled.
Email Auto-Protect, Download Insight, Outlook Outo-Protect, etc. being dissabled will cause the AntiVirus and Antispyware Protection to continue to show as "OFF" even though file system autoprotect is running.
To prevent users from disabling Symantec Endpoint Protection features on the client, see the related article linked below.