SGN 5.6 - Configuration Protection

Hi all,

I'm new to SGN, but learning fast.

Have installed the Server (IIS), created the Database, MSO, certificates, etc..., Server package, PC Package.

All looking good.

Have the clients software (preinstallation, client_x64, and PC Package - updating policies from SGN sucessfully), installed.

Have defined the appropriate Policy Items and Policy Groups, White Lists, etc...

But I can not get Configuration Protection to take effect - anything USB is allowed - even though policies are set to Restrict.

I have even created a test policy, Blocking everything, with a Test Policy Group, and assigned them to specific AD OU's, along with the Test User and Test PC. Blocked inheritance at the OU level, and selected 'No override'.

Then resynched AD to make sure everything was upto date AD wise...

But the test machine still happily allows any USB device to be plugged in and used.

Each time I change the policy and Synchronise from the PC to the SGN Server, I get the information balloon saying that the new policies have been recieved.

I assuming I'm missing something simple, but I've no idea what.

I've followed the PDF's, looked on the Sophos site and forum, but just can't get anywhere with it.

Can anyone help?

Thanks, Mark