Preventing User to turn off Features

Hello together, 

so, i have a SEPM14 running in a Win10 environment and my Admins are able to turn off Features (e.g. Firewall) in the Client Interface. And this is bad and i don't want this. :-)

So i went forward and set the Policy "Client User Interface Control Settings" (What a name) to "Server Control":

Sadly my admins are still able to Change those settings.. And yes, the Police is inherited by the instances below.

It's like the Policy gets overwritten from another policy? Is there another Policy for this somewhere?

Maybe someone has an Idea about this.

Greets,

Florian