Have you run a RSOP against the user to make sure they are given the ability? Where did you set this gpo?

Was this where you enabled it:
<i>
under User Configuration/Administrative Templates/Network/Network Connections/Ability to Enable or Disable a LAN Connection.</i>?

If they have been assigned this GP and it is not explicitly denied else where it will work.

For testing like this i like to create a test ou and test user apply the policy to him and try it before rolling it out.

Another possibility would be a shortcut to a script file that enables/disables the adapter. The shortcut would run it as a local or domain admin.

It could look something like this:

REM Restart Wireless connection to force broadcast IP request.
REM Don’t restart if ping successful.
ping -n 1 yahoo.com
if %errorlevel% EQU 0 goto end
devcon restart PCI\VEN_14E4*
:end

You need to change the PCI\ (ID) to be your id of your nic.

Let me know if you need more assistance on this.