I have a collection in SCCM 2012 R2 where I want SCCM installed, but not SCEP. I created a client policy with a higher priority and Managed Endpoint, and set Install SCEP on Clients to No. However, when I push SCCM to systems with this policy it is still installing SCEP.
To me, it looks like when the SCCM client is installed, the system is temporarily removed from collections based on OU until the next incremental/full update. At that point it only has a policy for managing SCEP and installing it.
How can I exclude specific collections from getting SCEP?