I think an easy way to handle what settings a user can or cannot change would be to have an exact copy of the user SEP gui inside the SEPM in the settings of every group. Then SEPM administrators would be able to lock options or allow changes exactly in the same way they are seen in the client console. The way it is now, it is hard to locate where every locking setting is in respect to the client SEP gui.

thanks.