The Firewall policy is locked, however the Firewall can still be toggled locally on the SES for Mac client. When disabled locally on the client, the machine will show 'At Risk' in the console.
Release : 14.3 RU5
This is due to the setting under User Settings: "Allow the following users to enable and disable the firewall".
When this is enabled, users can disable the firewall locally, causing the machine to show 'at risk' in the console.
Disable the option "Allow the following users to enable and disable the firewall".