When we change the policy in EEFF there is no sync problem with clients but they spend so much time ciphering files and they are too slow reading target folders and enforcing the new policy (more than 24 h) . There are about a 3 GB of data to crypt and about 12 GB of data to decrypt. There are only 3 clients. We've got key cached locally and no network bandwith limit. And only one key. The default policy is to cipher all data in one shared network folder and there are a list of exceptions (folders inside the shared one).