IE8 Compatability View Mode for Intranet Sites Group Policy

I cannot open \domain\sysvol however I can open \DomainControllerName\sysvol fine and see 1 node.

This seems to support Evan's theory that you have more general problems with your AD. Can I suggest that you back off from the firewall specific job for a bit (just too many variables there) and try setting some other group policies, then seeing if they take? It won't resolve the specific problem you're having, but it will help in confirming if the theory is correct.

Can you also check that the File Replication Service and DFS Service are both running on all of your DCs? Also that each can resolve name-to-IP and IP-to-name for both themselves and all other DCs, that each has a correctly set FQDN and that each can resolve your domain name to your DCs IP addresses using nslookup.

Finally, you should use replmon to determine that your AD replication is healthy, and resolve any issues that throws up before proceeding with anything else.

I've never had occasion to have Group Policy Administrative Templates "partially apply" in the manner you're describing. My gut says that the root cause is that the specific GPO that sets the "MSCompatibilityMode" is either not applying to these 100 users.

Is the "MSCompatibilityMode" setting (called "Include updated Web site lists from Microsoft" in the Group Policy management console) being set for the users in the same GPO that contains your other IE8-related settings (the ones that you're talking about when you say "though they did get other IE8 policies")?

I'd run the Resultant Set of Policy (RSoP) MMC snap-in on an a user who is getting the right settings and a user who is not and compare the lists of GPOs applied.