You need to turn on logging and see what the logs say. There are a couple of possibilites. One the upgrade failed. Two the policy is corrupted and it has the IPS module set to off. Three, there is something wrong with one of the components and the logs will give some clue to why the module is off.
Thanks Joe for your feedback. Are there any other logs I can check without turning on the logging mode in the troubleshooting section? So I can do some troubleshooting with disable clients. How can I check if the policy is corrupted? I have 800 machines that are disable and 500 were good results.