If you have Internet Explorer security settings in a Group Policy, a user can change the security settings and the Group Policy will NOT be re-applied when they next log on.
This 'feature' is due to the fact the Group Policy is not applied unless it has changed.
To workaround this 'feature':
1. Open the Group Policy (Default Domain Group Policy or the OU Group Policy). If you haven't created a custom MMC snap-in, open Active Directory Users and Computers, right-click the domain or OU, and press Properties. Select the policy on the Group Policy tab and press Edit.
2. Navigate through Computer Configuration / Administrative Templates / System / Group Policy.
3. Double-click Internet Explorer Maintenance Policy Processing, Enable the policy, and check Process even if Group Policy objects have not changed.
4. Press Apply and OK.
5. Set tip 2184 to force an update now.
