Perhaps this is a n00b question but I have been all through the SEP12 interface and all of the policies on the SEPM12 server and cannot locate a way to lock down the SEP12 client such that the user can't go into the options of the Network Threat Protection and turn off the SEP firewall.  Does anyone know of a way to block the user's ability to do this short of adding a password to access the SEP client?

How do you lock down SEP client interface so that end users cannot disable components or modify settings.

http://www.symantec.com/docs/TECH136678

How to prevent SEP features from being disabled in the client GUI in SEP 12.1

http://www.symantec.com/docs/TECH168990

http://www.symantec.com/docs/TECH185903

To prevent end users from disabling Network Threat Protection:

1. In the Symantec Endpoint Protection Manager, click on Clients and select the target group.
2. Under Policies, expand Location Specific Settings and open Client User Interface Control Settings.
3. In the dialog box, select Server Control and click on the Customize option.
4. Uncheck the 'Allow Users to Enable and Disable Network Threat Protection' and click OK.

Securing the Symantec Endpoint Protection (SEP) client user interface and settings.

How to disable SEP features at client GUI in SEP

https://www-secure.symantec.com/connect/articles/how-disable-sep-features-client-gui-sep-121

Excellent thank you guys.  GREAT work on prompt reply with answer!!!