To make a long story short, I have finally figured out that the reason my workstation-associated applications work when I test them, then didn't when I put them into effect, was because I was associating them to workstation objects when testing, and to workstation containers later, where they stopped. Associating applications to 1900+ workstation objects is a pain, especially when I have to add new workstations to several apps. I would have thought that associating the apps to the OU where I move them would have been enough. Is there another way? Associating workstation groups to apps doesn't seem to work, either. Yet either way works fine for associating apps to user objects.