Please use option Restrict.
If you're looking to open the CLI from a CLI perspective/context you can use the following command:
\> sadmin recover
\> System Controller Password:
\> Local CLI has been successfully recovered.
You'll be prompted to enter the System Controller password, after which you'll have access to the elevated session.
Were you able to get this figured out? It sounds like you just did a deployment so I wonder have you configured the Local CLI password? I think you can still do an sadmin status w/o having CLI Access. If you can see what the System Controller says. You want it to say "McAfee Agent". If it doesn't then the McAfee Agent isn't "talking" to the Solidcore (MAC) software. No amount of changes made via ePO will do anything if that's the case.