Doubts about system lockdown

Hi folks,

We are planning to implement System Lockdown in our clients and we are with some doubts:

1. System lockdown can be implemented only by group or it can be implemented individually by machine ?

2. System lockdown can be implemented without a SEPM Console, directly on the client ?

3. In an emergency can System Lockdown can be disabled on the client ? (Some emergencial cases where the given application is not on the whitelist, need to be executded, and the user can't wait a change on the console)

Our enviroment:

Symantec endpoint protection SEP and SEPM version 12.1.5

Clients:

Windows XP,

Windows 7

Windows 2008

Windows 2012

Thank you!

Giordano Abreu