How to block a user's ability to disable Symantec Endpoint Protection on clients