I have configured SEPM to quarantine keyloggers and installed a package called "Active Key Logger" (suggested in Symantec SEP test document). 

 

This is running completely unimpeded by the SEP client.  I have checked the Proactive Threat Protection settings on the client and this is set to quarantine and notify.  The key logger is not being blocked, logged or quarantined and there is no notification.

 

Any ideas, anyone?