Client is receiving policy updates, but fw rules not applying

Client is receiving policy updates, but fw rules not applying

Dropping a new client in existing group.  Policy is updated, client appears to be working normally, however fw rules and logging is not applying??

I have no clue where else to go with this.  Have verified everything in SymDiag, dug through every log I can find.  Enabled client side debugging..

I cannot figure out why 2 clients in the same SEPM group act totally differently.

Possibly missing something easy here???