Most likely there will be nothing in any ZENworks Logs.  ZENworks only puts a POL files in place and invokes the Windows APIs to enforce the GPO.  Windows is returning some error code when applying them.

If you have multiple GPOs, I would start by testing them one at a time to see if any single one works or fails.

Since it is hard to BLOCK a GPO, once trick may be to add a SYSREQ such as HKLM\Software\Test\MyGPO<>false  ...then set that value on a device you want to skip the GPO for test purposes.

The following software also makes it easy to see which GPOs are applying.

https://sdmsoftware.com/389932-gpo-freeware-downloads/registry-pol-viewer-utility/

Also check the WIndows Log in the Event Viewer for Errors, often it may give you an idea which specific policy setting may be tossing an error.  Most likely its a policy setting you don't care much about since all seems to work.

--

Logging can be set with GPSvcDebugLevel

https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/applying-group-policy-troubleshooting-guidance

However, I tend to find the Event VIewer or a simple process of elimination by only applying some policies, or creating a test policy and slowly adding in entries until you get an error. 

In rare cases, I've seen it cause by old leftover entries in the GPT.INI where it's trying to enforce a set of policies defined by a GUID when there are no actual related settings....often a fresh GPO may clear that.  It's been a while since I saw that, but if you transfer all the settings from an old to new policy and the errors don't come back that could explain it.

Hey Craig,

thanks for the reply and your in-depth knowledge. I will check the links and come back, hopefully with some results...

Edit:

i also use your GPO-tweaks already...