Where is MCX Cache?

Initially we were disallowing PhotoBooth via User Group in WGM. Now we've removed it from the disallowed list. The vast majority of my client machines got the new setting on restart and users are successfully running PhotoBooth. Several machines, however, won't let go. The app is still in the deny list of /Library/Managed Prefs/Username/com.apple.applicationaccess.plist. Tried purging MCX cache in NetInfo Manager, tried purging contents of /Library/Managed Prefs/ to no avail. Where is com.apple.applicationaccess.plist coming from?