When does the Symantec Endpoint Protection client switch to user mode?