Having an issue blacklisting a single SSID. ZCM 11.0 vanilla, Windows 7 x86 client.

Now if I'm reading the doc and the help file right then all I should have to do is create a wi-fi policy, blacklist a single SSID in the policy, assign the policy to a machine object (for testing) then make sure you have appropriate locations assigned to that new policy. To blacklist a SSID but allow all other SSID's to work all that is needed is to add the one blacklisted SSID to the policy, at least the doc reads that way.

I have all of this in place, ZES on my test client shows that the wi-fi policy is in affect in the current location, the unknown location since I'm on no network for this test. The banned SSID still shows up in Windows and I can join it with no problems. I have tried various SSIDs I have locally here, but with and without MAC addresses of the WAPs included. No dice.