I would like to disable all Auto-Protect features on a managed client with a non-privileged account.  Under the appropriate policy, I have made sure the paddle lock is not closed:

But on the client I am unable to change any configuration:

Is there a way to allow standard users to disable scanning?

Thank you,

are standard users not able to?

That is correct.  On the client, when I right click on the shield icon in the system tray, select Open Symantec Endpoint Protection, select Chage Settings on the left, the Configure Settings button is unclickable.  When I hover over it says it has been locked by the administrator. 

Is there another way to disable scanning? 

If I run Smc.exe from from the command line, it asks for administrative privileges

What version of 12.1 are you using?

You can set the users to Mixed control and this will allow them to disable

About mixed control

You need to put that under user mode only then you will be able to change it

Changing the user control level

http://www.symantec.com/business/support/index?page=content&id=HOWTO55475

The clients are at 12.1.3001.165 and the server is at 12.1.5.5337.5000.  I will look into the Mixed controls more but the article says by default client control is enabled.  I will test with switching to user control  and see if that helps.

Actually I believe they're in server mode by default

Did you try logging in as a Admin on that client PC? Also, change the control mode to User.

Happy to help, take care :)

-Brian