I ran into an issue changing the Installed Feature set on clients and i wanted to share my solution.
I was following the below tech Article on how to add or remove features:
http://www.symantec.com/docs/TECH90936
What was happening is that when the client received the new Install Package with the updated feature set, the client would never update its installed features.
For example, if i had a client group which was installed without the Firewall feature, but then i wanted to add the Firewall feature it would not install.
After tons of searching around i found the following VERY helpful post:
https://www-secure.symantec.com/connect/forums/remove-sep-components-update-content
My situation was very similar. If the client was upgrading versions (for example from 12.1 RU3 to 12.1 RU4) everything would work as expected. However if you are staying within the same version, the feature set would not change.
In the above linked forum post, the resolution was disabling tamper protection and removing the Uninstall password. I tried both of these options independently and i found that the uninstall password is what was holding up the installation.
So in summary; if you have issues with changing the Installed Feature Set, ensure you disable the Uninstall Password option before deploying the Installation Package to the target group.
I hope someone finds this helpful. Additionally, i think it would be worthwhile for Symantec to note this in the How To article at the begining of this forum post.
Thanks!