Track Firewall Disabled or SEP un-installed

Is there any specific way to determine the following:

1. Alert when Firewall component is disabled by a user in SEP client?

2. Alert when SEP client is un-installed either from control panel or through cleanwipe. Uninstallation of applications can be tracked through windows logs. However, I wanted to know if SEP client could generate a log and send to SEPM when client is to be un-installed.

Thanks in Advance!!!

PS: I have enabled client password protection to start/stop services, un-install clients. Also, admin users also cannot disable SEPM with my policy. Cleanwipe does not prompt for password to remove the SEP client.