Try moving the client to another group, then update the policy, leave it for a heartbeat interval and move it back to its home group. Sometimes if the client has not fully received or implemented a policy, or if it is not communicating properly, it responds to an entirely new policy and gets back in step with the SEPM server.