Whether it's set by the local security policy or by the domain security policy, shouldn't it be the resulting settings that are scanned in, not just the local?
The other part that is baffling is that machines that were built with the same base image are showing different values in inventory. All the machines are bound and subject to the domain security policy.
Thoughts?