Windows 8.1 clients can disable SEP

Greetings - I found out from a User that they can right click on the SEP Shield and select the option to Disable Symantec Endpoint Protection. The computer was in a group in SEPM for Windows 7 machines (I keep 'em separated) and those assets have the option grayed out. The SEP Client version was 12.1.4112.4156. I upgraded a couple of them to version 12.1.5337.5000 but they still have the option lit up.

Is this a bug specific to the Wnidows 8.1 OS?

Thanks,

Lawson...