Application Control is blocking domain computers

When Application Control is enabled on Fortigate 100F v6.4.0 build6025 (GA) then every domain computer cannot communicate with domain controller:

gpupdate /force is pending and do not executing.

On "Log & Reports--->Application Control" is see that traffic destined for domain server have everywhere action PASS.

When I disable Application Control communication to my domain controller is back, and again I can execute gpupdate.

What da heck, how to troubleshoot this?