In group policy, have you:
Enabled “disabled computer configuration settings”?
What is your group policy refresh interval set to and how long has it been since the GPO settings were applied?
The GPO is linked to the domain?
Have you run “secedit /refreshpolicy machine_policy” on the workstations?