After a conversion to Windows 7, I have set up a Group Policy (ugh!) in our SBS 2008 domain to turn off the Windows Advanced Firewall. This has been in force for several weeks.

However, I find, after a reboot, in the Logon Scripts, that only about half (10/19) of the PCs have the Advanced Firewall turned off. It's the same ones each time.
For the others, I need to run
netsh advfirewall set domainprofile state off > nul
to turn it off.

Can anyone explain what is going on, because I can't!