Moved provisionally to ePO for better handling.
My suggestion would be not to let the users disable access protection. It is one of those key features you want on. When configured correctly stops the ability to stop the on access scanner as well as protecting file and registry keys for the mcAfee products.
But I'm not aware of any way to log it. You might want to log when the services get started or stopped, or the scanner get started or stopped.
That can be logged in ePO by turning on the appropriate event type in Menu, Configuration, Server Settings, Event filter