As my company migrates from MDFW 8.5 to HIPS 7 patch 2, we're seeing 4-5 people a week where their FW8.5 goes into Learning mode and is prompting them with "Allow/Deny" pop-ups. CMA 22.214.171.1248 and ePO 3.6.1 patch 3. It was never this bad before. We'd get maybe 1 or 2 of these calls in a month. Now, 4-5 a week. It's like FW8.5 is self-destructing.
MDF was never tested with those versions of CMA/ePO. The was an issue with MDF loosing policies but it was fixed. You may have an old version of MDF and the newer versions of ePO/CMA are exposing the problem.