SEP Host Integrity Policy Question

I recently began testing the SEP Host Integrity policies. We activated rules for antivirus, firewall, and Altiris to be required but put them in pass but log mode. In the time frame that this was done, workstations in one of two buildings had the programs listed in 'Uninstall or change a program' replaced with a message that the 'System Administrator Has Disabled Programs and Features.' Our senior network engineer has placed blame for this event on SEP and so I am inquiring if anyone has experience with the Host Integrity Policy doing this without a specific rule being added. My main reason for doubting SEP as the cause is that this issue only occurred in one of two buildings where the changes were made.