Best way to permanently disable NTP and PTP from SEPM (v12.1)

Hi

Im running SEPM 12.1, with mix of 12.1 and 11 clients. Mostly version 11 at this stage.

I have created a group and testing some policies to disable NTP and PTP for a particular reason.

I have disabled Firewall policy, by unchecking the tick box "Enable This Policy".

Did the same for Intrusion Prevention policy.

Updated the policy on the client, but still showing as all three items (AV, NTP, PTP) as "ON". Rebooting PC made no difference.

Not keen on doing reg hacks to get this working. Would like to do this via SEPM policy.

Also dont want to use SEPM commands, as i need to permanently disable NTP and PTP.

My last resort will be to upgrade the v11 clients with v12.1 clients, with NTP and PTP feature removed.

Any other way i can achieve this via SEPM policy?

Thanks, DM.