Default Domain Policy is configured to allow System Restore. Registry settings in the policy are also set to update computer registry hex value for restore to 00000000. This applies about 50% of the time. The other 50% of the time, it ignores this and sets the hex value to 00000001, which disables the users ability to create a restore point.
There is not another policy for the OU, it should apply the default domain policy.
Best Answer
I'm guessing you have more than 1 Domain Controller and it seems like you have a replication problem between them, computers that work are probably getting the GPO from the DC where it was created and the ones that don't from the other one.
Those revision numbers suggest AD is replicating but not Sysvol, you can confirm this by checking the version number in the GPT.ini inside Sysvol on each one of the DCs for that GPO:
If this is the case then you need to troubleshoot replication, you can try forcing it but how to do that depends on if you are using NTFSR (2003) or DFS (2008+) for Sysvol replication...