how to prevent disabling SEP

hi. i'm evaluating SEP 12.x and the first thing i usually do is prevent users from disabling any antivirus installed. with SEP 12.x, if a user right clicks the shield icon and click on "Disable Symantec Endpoint Protection" it goes and disables it.

i have read and gone thru all the posts here http://www.symantec.com/connect/forums/how-disable-disable-symantec-endpoint-protection and still users can disable SEP.

how hard can it be to prevent users from disabling the antivirus?