I found out what was going on. You must use a query for Managed Devices (e.g. you cant use a Policy Query, Encryption State query, et. al). It works fine by running multiple queries in one server task. You run one to query the policy or disk state you are looking for, then set a custom attribute to any value you want... then come along with your Managed Devices query and query for Custom 2 (Or whichever one you used). THEN, you can use the Clear Tag sub-action.