There are two potential causes for this issue:

• VSE is not installed on the ePO server.
  The VSE extension that is checked in to ePO displays the policies for AP rules using a variable that is translated at runtime when the policy is being rendered. The rendering process reads registry data for the VSE installed product to translate the variable. If VSE is not installed on the ePO server, the extension is unable to render the path information properly and defaults to the string (\:::).
  
  When the same policy is modified through the ePO console, the improper value (\:::) is written to the database as the new policy. Which then overrides what is being enforced on the clients, and in turn leads to the problem described above.
  
  When the policy is not modified, clients are enforced with the default policy. The default policy is enforced even though it contains the variable for path information. It is translated properly on the clients, and no issue is incurred.
   
• VSE is installed on the ePO server, but is installed to a different drive location than what has been defined for client systems.
  In this scenario, when a policy is modified in ePO and if it contains path variables, the variables are expanded in the ePO server policy. Which represents the installation path of VSE on the ePO server. When that differs from the install location of VSE for the clients, then the exclusion does not match and violations occur on the clients.