Thanks for the replies.
Yes, I did apply all the locks and no, it did not prevent users from disabling. Well, not all of them while they are in the same group and hence having the same policy!!
My conclusion is that there is a difference on the workstation itself that causes this to 'fail'. I already read about the setting for 'simple file sharing', but that isn't it.
Still on some machines the option 'Disable Symantec Endpoint Protection Small Business Edition' is not greyed out.