We have ZCM 11.0 running on a windows 2008 R2 sever in a 2008R2 level AD Domain.
The problem is with printer policies. We have some printer policies set up to push a Windows printer share as a device associated policy which seems strait forward and simple to configure and the printer deploys. The problem is the printer will not stop deploying every time a user logs in to the workstation it goes through the whole thing again, Connecting to the printer Looking for a driver Installing the driver.
SO
Question 1: What is the problem here, why, if this is a device associated object does it reinstall multiple times a day.

Question 2: If this is a device associated object, why then does it attach itself to every users profile that logs into the PC and then follow them around (without having to reinstall on every login on the next PC that the printer is not associated to) but we do not want or expect a device associated printer to follow the user object.

Question 3: when the Workstation is off the network (users that take a laptop home and log in to the laptop locally) why does the group policy continually repeatedly keep trying to install the printer and obviously failing?

We have already set the Reg keys as below to stifle the Zone popup when the user is not on the network but that does not stop the printer/printers from continually trying to install itself.

31.4 Disabling ZENworks User Authentication
By default, if a user source is defined in the ZENworks Management Zone, the ZENworks Adaptive Agent attempts to authenticate a user to the zone whenever he or she logs in through the Microsoft or Novell client.
If necessary, you can disable user authentication to the zone. For example, you might have some users that only receive device-assigned content, so you dont want the overhead of having them logged in to the zone.
To disable user authentication to the zone:
1. Locate the following key in the registry on the users device:
HKEY_LOCAL_MACHINE\SOFTWARE\Novell\ZCM\ZenLgn
2. (Conditional) If you want to disable login, add the following DWORD value:
Value name: DisablePassiveModeLogin
Value data: Any non-zero value (for example, 1, 2, 3, 100)
With login disabled, no attempt is made to authenticate to the Management Zone when the user logs in through the Microsoft or Novell client.
3. (Conditional) If you want to disable the ZENworks login prompt that appears if login through the Microsoft client or Novell client fails, add the following DWORD value:
Value name: DisablePassiveModeLoginPrompt
Value data: Any non-zero value (for example, 1, 2, 3, 100)
Normally, the Adaptive Agent attempts to authenticate the user to the zone by using the credentials entered in the Microsoft or Novell client. If login fails, the ZENworks login prompt is displayed in order to give the user an opportunity to authenticate with different credentials. This value setting disables the ZENworks login prompt.

Any help would be Greatly appreciated