allow disable Symantec Endpoint

Hi,

I have last Symantec Endpoint version 12.1.6 MP2 in Windows 8 and Windows 10 clients.

They are managed by SEPM.

I want to give permissions to users for disabling Symantec Endpoint.

The users are not administrators in computer. 

Computers are in a domain.

I am not able to set up SEPM to allow disble completely to user the Symantec Endpoint. 

I have tested a lot of options (enable/disable /checked/unchecked)

I have attached the screens

Thank you