Endpoint Protection

I have done it before but today when i go to try to switch my machines to user mdoe, the option is greyed out.
It is like this for all machines.

Any ideas ?

If the option is grayed out in that case the client might be offline or not showing up with the green dot on the server. 

The clients are online. I've attached a screenshot

If the AD is synced with SEP Manager in that the switch to suer mode would be grayed out. 

I thought it used to allow me, but maybe not.

Would you advise addming the machines via an import rather than a sync?

It completely depend on how you want to manage and what are the requirements. 

1. 
   It would suggest you to first identify the requirement and how exactly you are planning the deployment of the SEP on your network. 
2. Once you have the clear set of requirement, try to determine how best the product can meet your requirements. 
3. After that you can determine whether to create groups manually or import AD. 

If you can post in your requirements I can help you to jot down the plan for Staging and deployment. 

Thanks for your assistance.

I want all users to have the same AV and Antispyware settings.
The differences come with Device Control.

I need all standard users to have read-only access to all USB keys.
I also need all standard users to have no access to CD-Roms.
Admins need full access to both.

I will be deploying SEE soon to encrypt the files written to USB, and encrypt the laptop HDDs, but that is a seperate need.

According to the requirement which you have posted I do understand that you want to have user based policy on all the clients irrespective of the computer on which the user login. 

In this condition you have to install the clients in USER MODE and create the policies according. 

1. For antivirus and antispyware policy you can create a shared policy for all the group. (Even if you un-check the option of Policy inheritance from parent group this policy will remain same for all the group).
2. The application and device control policies can be configured depending on the User OU which you can import from AD. 

Note: - The OU structure should be according to your requirements. If that's not the case then there are two possible way to configure it. 

1. Change the OU structure according to your requirement if you are comfortable doing the same.
2. Create group in SEP Manager and add user accounts which to each group(It would be a manual process).

At the time of creation of package you have to select the preferred mode as user mode. 
Please feel free to revert back in case of any queries. 

Thanks.
I have already deployed the client packages.
Is there anyway of converting them to user mode, or do i need to re-install ?

Hello Mark, 

Kindly let me know whether you have users OU imported to SEP Manager?

Not currently, just the computer OU's.
I installed via creating a setup.exe and installing manually as i have only a few clients

You can get a batch script for converting computer mode to user mode for a group of clients by calling Symantec Support.

good informtion it really helps me