When installing a client package without Network Threat Protection (NTP), if a Firewall Policy is associated with the group on the Symantec Endpoint Protection Manager (SEPM) the Windows Firewall is disabled.