I used to be able to run "smc -stop" and a password prompt would pop up and I could manually stop the SEP firewall (assuming I was logged into the machine with administrative rights). I tried doing this in SEP 12.1.4 and it doesn't seem to work. Has something changed?
Assuming you have the password mechanism applied to the group the client is in it should work as before. Did you verify?
yes
it should be start smc -password
have you disabled the tamper protection?
On Client GUI Try with
Change Setting-->>Network threat protection-->uncheck Enable Firewall.