I'm having some issues with File and Folder permissions that are assigned by a ZCM policy.

If the user is logged into ZCM these work fine, but if a users connection is interrupted, or if they are away using a laptop the file and folder permissions drop off.

For example, we are assigning write access to C:\Program Files\Myprogram to Authenticated Users.
When the user is in the office and logged into ZCM they have write access to this, but when they are out of the office (or ZCM connectivity is lost) they do not.
Our needs require that any assigned folder permissions stick regardless to the user being logged into ZCM or not.

A couple of questions.
1 - Is this by design, or is it a bug?

2 - Is there anyway to force the folder permissions that have been assigned by ZCM policy to stick for when the user cannot login to ZCM?

3 - If the policy is assigned to USERS rather than AUTHENTICATED USERS will it make any difference?

I can create an action in the bundles that will use setacl.exe to set permissions on install, but we are trying to move away from using this.