To be absolutly sure that users aren't able to disable McAfee you need to secure the User Interface & set the Access Protection Options.
Without the UI being locked the user can just fire up the console & disable the Access Protection feature.
For troubleshooting work I create a 2nd Access Protection Policy with it set a disabled & then apply it to the machine requiring the fix, remembering to reset inheritance again afterwards.
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center