Endpoint Encryption

 Changes to a client computer rely on either connecting to the SEE Manager (for clients that use Native Policy) or a Domain Controller (for clients that use AD Sync + GPO to enforce/change SEE policies).

In short, if the user doesn't connect, changes don't happen.

You can force the users to connect once in a while by enforcing a check-in period and lockout; See the manual for further information on this feature.

is this wohle update-system only working when activated client side ?
or is the admin able use the manager to update policies/clients on selected/all clients
when using native and not actice directory -> some may not have a common AD tree (yet) due merging offices/companies

When you install see on a client machine then it will automatically try to connect to the server. If it can find it then it will check in else it won't . With AD you can specify see policy and can make it specific to an OU.

Native policy can only be applied on computers