Prevent Mac users from disabling Endpoint

Hi..

Was wondering if there was a way we could prevent all users...including those with local admin access on their Mac from disabling antirvirus and spyware protection.

Experience shows that even if it is disabled, server policy will enabled it once again automatically, but wanted to check if there is a way to keep it from getting disabled altogether.

Any thoughts?

Thanks!

-A