Is there an option for 'group policies to remain in effect after logout' in ZCM
like there was in Zen7?

If someone logs into the local 'workstation only' after someone has logged on
as a student, they are getting stuck with that students GP... is this intended
behavior or did I miss the check box?

I don't use AD, just ZCM.