Sounds like when you disabled Lotus Notes Email Protection that you disabled it within the policy. This is great except that if you forgot to set the "Lock" icon to the left of the checkbox to the "Locked" position then the client will report it as an error instead of something you intended which would then cause the shield icon to show the disabled status.
This document will explain it in better detail and how to correct it if this is the case:
Title: 'How to disable the "Fix" button notification after turning off email scanning in Symantec Endpoint Protection.'
Document ID: 2007080710002748
> Web URL:
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007080710002748?Open&seg=ent
Hope that helps!