Well, to check which systems have gotten the GP update, while logging into the domain, they should automatically pull the GP. There is a time-out period where they should automatically grab as well if they are currently logged in when the policy was changed. Can't remember off the top of my head what the settings name is. As far as worrying if someone changes their policy on their local machine. That's Local Policy, which is over-ridden by Group Policy. Unless said user is a domain admin changing domain policy of course :p Hopefully that helped. If not, well, I tried
