Thanks for reading this post!

Environment:
Windows 10 version 1151 and 1607
ZCM 11.4.2 running on 3 SLES 11.3 Server
Non-Domain OES Client Login
WSUS on Windows Server 2012 R2

GP=Group Policy
Situation:
I am having issues with Windows GP from ZCM being enforced on our network systems consistently. This is causing system that have no GP enforced to go out to MS updates and download the anniversary update and installing that update. I have not released that update through WSUS because of some older software that requires .Net Framework 3.5 installed and when the update installs it does not install that feature. The issue is showing up in an inconsistent manner. Sometimes I will see in event viewer that GP processing is taking place and sometimes it will not. There seems to be no pattern of why it will not enforce GP. I looked at the zcd-message.log file, but did not see anything. Better minds might! If I run a zac cc and then a zac ref the GP will enforce but after the user logs off, it is only hoping that the GP will still stay enforced. I looked at docs for GP troubleshooting in ZCM 11.4 and tried the registry setting [HKLM\Software\Novell\ZCM\GroupPolicy]
"ReApplyPolicyatDeviceStartup"="12", but that worked once and really does not solve my issue. Does 11.4.3 have an better GP processing? Anything I missed?

Any help will be appreciated.

Tim Overdorf