Disable scanning from Client

I would like to disable all Auto-Protect features on a managed client with a non-privileged account.  Under the appropriate policy, I have made sure the paddle lock is not closed:

But on the client I am unable to change any configuration:

Is there a way to allow standard users to disable scanning?

Thank you,