. . .no matter how experienced, educated and “crafty” *heh* sometimes the best answer is to throw one’s hands in the air and. . . go check OPE (Other People’s Experiences). Almost invariably, someone, even someone with all sorts of certs and official qualifications, has had the same intractable problem and has fumbled around and eventually churned up a workaround from the muck on the stable floor.
So it was with this problem/answer.
Short and sweet(er than not): error message stating some third-party security apps were blocked from running by group policy. Checked group policy editor and even did a “gpresult /h” (to have a nice html file report to read in a browser) and no, they were not. . . according to Windows. Still blocked, though.
Kludge-around: back up the Policy keys in the registry. Delete those keys. Force a GP update. Ta-da! All’s well. But. . . I really hate deleting keys, even when they’re backed up, so I’d not gone that far. I would have preferred fixing the problem the right way–in Group Policy Editor. Nope. *head-desk* “It’s Windows, dummy. Do it the roundabout, kludged-up way.”
*sigh*