SEP 12 - Disabled the "Disable Symantec Endpoint Protection" option, but what option when password entered

I am still in the process of preparing SEP 12 to push out to the users.  I have the "Disable Symantec Endpoint Protection" option when you right-click the icon in the notification area.  That is the way that I would like that to stay.

When you open SEP, and asks you for the password, I'd like to click the Options button on "Proactive Threat Protection", click "Change Settings", and in the window that opens disable SONAR.  This option is checked and greyed out right now.

Mainly, I'm wanting a way to prevent the user from disabling it because they don't have the password, but allow me to if I need to.  Any ideas?

THANKS!