We have Windows 7 users who are intermittently getting errors upon login saying that certain programs are unable to run due to software policy restrictions that come from our workstation group policy. I really need some help getting to the bottom of this as users sometimes need to log out and back in 3-4 times before things return to normal.

When the problem occurs, it can be in varying degrees. It can stop programs from running in the login script, including our SSO utility that allows Internet access. It can also prevent the running of the Windows script host to execute some scripts we need. In the worst case scenario the problem continues through the login and the user is unable to run other applications such as Internet Explorer, Word, etc. The crazy thing is that nowhere do we have a policy to block these things. My one and only workstation policy is configured to block running all applications by default, but then it explicitly allows everything our users need, including all of these things I just mentioned. I have been blocked myself from running apps when I log in even though I can check the computer's policy at the time and see that those things are allowed.

As best as I can determine this problem began about the time we upgraded from ZCM agent 11.2.4 to 11.3.1 in order to correct another serious problem, and right now I suspect that the agent is responsible for this issue, too. I'd like to test that theory, but Shaun Pond said in a 2011 post that downgrading the ZEN agent is not possible. I would very much appreciate any assistance. Thank you.