I would like to add that a lot of our servers are still running version 10.1.1 or 10.0.1 but the Security Center detects all of them as 10.1.2 and applies the 10.1.2 policy to them all. This is what causes the older versions to run on User-defined settings . However, we are not ready to upgrade all our servers to 10.1.2 and now we have no possible way of applying an older policy to those servers.