How do you make “Run Only Allowed Windows Applications” run without issue?

I work as a network admin at a school. We are running Windows Server 2003 R2 as a domain controller. Under the GPO for the students, we have “run only allowed windows applications” enabled, with a number of applications in the properties dialog.

Here is the issue: sometimes, even if the program is in the list, it still won’t run on SOME of them machines. It is like the GPO isn’t updating. I have run gpupdate /force from the command line, and that works about 50% of the time.

Is there a better way?

BTW, the student will get the error: “Access to this program has been restricted. Please contact your system administrator.”

Any thoughts?