Is there a GPO setting somewhere that will cause permissions to be re-applied at reboot. For example, although we have SIMS permissions setup in GPO, these permissions only seem to be set when the computer joins the domain. Since SIMS is installed after joining to the domain, it doesn't get permission set on the SIMS folder, HKCR etc.