We are running SEP12.1 on Server 2008 with mix of XP and Win 7 Clients total about 400.  I created a new group with a non-shared Policy with various sections unlocked to basically disable if needed. I moved 10 units over to the new group then right clicked the group and chose the run command on computers and then update content. The monitor screen showed that all clients were updated successfully. When I logged in to few units and right clicked the shield the disable option was greyed out.  What is strange to me that if I logged in using my account as domain admin the disable option was no longer greyed.

I thought the SEPM pushed content out based on client name and not user credentials.

Any help would be appreciated.

if you login as  local admin then that option does not work, it will always be enabled.

Trying to enable this right? check if you have opened all the lock pads.. 

How to block a user's ability to disable Symantec Endpoint Protection 12.1 on Clients

http://www.symantec.com/business/support/index?page=content&id=TECH166238

Did you verify he policies match (client and SEPM)?

as per design administartor can be disabled

Disable the Symantec Endpoint Protection should be grayed out in admin users also

https://www-secure.symantec.com/connect/forums/disable-symantec-endpoint-protection-should-be-grayed-out-admin-users-also

The user account that the disable option is greyed out is a network user that does not have local admin rights.

see that articles and check configuration setting

How to prevent client features from being disabled by users in the SEP 12.1 client interface

Please review your polcies once. I am sure there is wrong option enabled on policies which is cause of this issue.