Endpoint Protection

As the SEPM administrator, i already set the Log Retention at the SEPM, but the client still able to overwrite the setting.
Is there any ways to disable the SEP client to change/modify the Log Retention?

To control the Client Log Retention is very important for our internal audit.

Have a look at this article
TIME PERIOD FOR RETENTION OF AV/AS LOGS IN SEPM

User still able to change the retention manually.
any other solution or suggestion?

If he changes also t will  be get back to the same value which you set in the SEPM at the next restart of smc service.This is what we can do maximum in this case.You can present this as an idea in idea section of  this form...

not really. i chanage my retention, next start will remain the same, will not change back to the SEPM setting.