You could try other (unpopular) solutions like emailing all staff that aren't enabled from the data within SafeGuard on an automated method until compliant (I do this with inTune now and it DOES work well), forcing a reboot of the machine every X days (and therefore they'd see the prompt more often).