The GPO has been set up for months. How could they not have it? Could it be because they are logging on before the GPO has been fully refreshed?

There are 2 domain controllers, and the two netlogon shares have all the required files.