Do you mean if somebody is disconnected from SEPM they should not be able to change anything regarding client configuration.?
If yes do as follows
Create a separate location and do as following doc
How to block user's ability to disable Symantec Endpoint Protection on Clients

For creating location refer this doc

How to create Out Of Office Locations Rule

How to configure System Lockdown in Symantec Endpoint Protection 11.0
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007092616355048

I mean if some one disconnect from sepm that should not use any thing except only he can sign in .
 For examples all drives will be disabled, browsers , only intial services can by that user can sign in and sing off.

Create a separate location say out of office.
Create a firewall rule to block all the connections,so that no browsers will work,I mean no network connectivity will be present.

you can also create an application control policy saying that no drives should be accessed(enter * and select all drive types) and create an exception for os folders

I think 2nd one is best approch,

Test it in a lab first..
The 1st one will disable anything related to network,for example browsing.
2nd one is for controlling the disk access..
Also assure that this policy you are applying to only out of office location..

aravindKM ,, kindly write here complete script ,,  my policy is not working,, and i m sure my script is wrong

aravindKM ,, kindly write here complete script ,,  my policy is not working,, and i m sure my script is wrong

Whether the client is received the policy?

yes

look what I done..

I added new rule.. ---> added condition terminate process....> process is d:\* .......> action...> block critical 0

Edit Firewall policy.
Click on rules-->add rule click next
select application click next
select define application click next,
File name keep as * and click next.
click on finish
It will appear as rule 0 rename as you like
In the action column right click and select block
Keep this rule as the first rule..

Assign the policy for that location.
Also keep the clients in server control mode in location specific settings..