Hello,
There was a known issue with Symantec Endpoint Protection 12.1 RU2 and that this issue was fixed in Symantec Endpoint Protection 12.1 Release Update 2 Maintenance Patch 1 (SEP 12.1 RU2 MP1):
Installing any Symantec Endpoint Protection package without the firewall disables Windows Firewall
Fix ID: 3063585
Symptom: After installing Symantec Endpoint Protection with a configuration that installs only Virus and Spyware or Proactive Threat Protection, the application still disables the Windows Firewall.
Solution: Updated the installer conditions to properly recognize previously stored Windows Firewall states and the install or removal of Symantec Endpoint Protection firewall components.
Release notes are here:
New fixes and features in Symantec Endpoint Protection 12.1 Release Update 2 Maintenance Patch 1
http://www.symantec.com/docs/TECH204685
The client-only patch can be found here:
Symantec Endpoint Protection 12.1 RU2 MP1 Client-only patches
http://www.symantec.com/docs/TECH204859
I would request you to install the Latest version of Symantec Endpoint Protection 12.1 RU3 on your network.
Hope that helps!!