SEP clients not initially enforcing new Device control policy correctly.

We have updated our device control policy to allow a piece of internal Laptop Hardware.

After pushing out the policy the laptops are still not able to use the harware until we manually enable it in device manager.

Once we do that SEP kicks in and recognises this as allowed and leaves it as enabled.

We tested trying to enable a black listed device via device manager, but SEP stepped in and kept this blocked (as it should)

Any ideas why the newly whitelisted hardware isnt enabled from the start?

Thanks.