Go to one of the impacted machines, go to the local GP and check to see if the policy is set locally. Local policies override domain policies if set.
While you said you forced a GP update on the local machine (right?) I wonder if something is getting cached. If a user logs off and logs back on then do they have the option now?
If a new user logs into a machine that is having the issue then do they have the option now?
Finally, check the registry HKCU\Software\Microsoft\CurrentVersion\Policies\System\DisableTaskMgr
and see if it exists and what it might be set to. If it is set then remove it and reboot.