you are right. However i did find 2 more entries in the broken machine compared to the working one, no missing things...
rsop of that machine/user also shows the same working gpo...weird.
Tried a freshly deployed machine now with same gpo - difference is only in the value for detectionfrequency which is not leading in the right direction I guess? Sorry my mistake, working_regexp is a machine with special WU Settings.