I haven't done it in a while, but if I recall correctly I only pushed a delta to the APs and it worked. Just tried now and it's part of the running config, so suggests a delta would be ok. I'm not in the office to check whether it blocks me from conn...
I'm unsure what it looks like on the WiNG side so may not be a direct comparison but there are two ways to block devices connecting via MAC:1. In the SSID > SSID usage you have a MAC Authentication tab2. At the bottom of the SSID > additional setting...
So that all looks fine. My other thought then is maybe something has corrupted on the CWP. I'd create a new captive portal in XIQ to see if that helps the issue as I have had issues (though can't remember if it was the same error) where creating a ne...