User is able to exclude file from scanning

Hello,

We have a SEP deployment that is pretty standard with little modification to the default configuration.  The users are unable to change settings due to "Client User Interface Control Settings" being set to "Server Control", however when a new file is downloaded the user is able to exclude the file from scanning.  In my testing it took a couple tries but the file remained and did not get quaruntined.  It was excluded from future scanning as well.  What setting in the SEP management console allows this? and how to I stop it?

Thanks in advance.