Patch Management –You can check if Patch Management software’s Like WSUS, SMS and PatchLink Solutions are installed and running. If they are not installed or working you can either run a script or re-direct it to a location from where these files can be installed.
Secure Workstation – With this template you can enforce requirement of Password age, complexity, Length and history. You can also check for requirement of Account Lockout, Disable Add/Remove Programs, disable Registry editor, Guest Account, IP address change, CD/DVD Burning, Disable Autoplay. If these options are not present it you can run a pre-defined script to enforce them.
check this link
https://www-secure.symantec.com/connect/articles/what-all-can-you-do-symantec-network-access-control