[dsb.nepo]

for the desktop rules keep in mind
- All Users@ -> rules apply if the client is disconnected
- DefinedUserGroup@ -> rules apply if the client is connected

You can verify this if you open the CheckPoint diagnose at the client side
from the 'windows program menu' and watch the applied rules.