Enterprise Console: workstations display the message 'Differs from group' : In Sophos Enterprise AV, I had been seeing every station come back with a 'Differs From Policy' message after they would reboot. Every time.
Turns out I had manually excluded all of the 'zip' extensions because of a scan I did when it was set to scan all files.
Since we no longer do that, the extensions are no longer on the list of extensions scanned, thus my exclusions were causing the mismatch.
*sigh*
I removed the exclusions and I no longer get those messages. But if I ever need to do a full scan of every file, I'll have to re-add the extensions to the exclude list, unless I don't mind scanning over 20gb of GHO, GHS, TAR, TGZ, and BKF files, depending on the system being scanned.