How to troubleshoot NRPT

Hi there, 

We are in the middle of a POC for AlwaysOn VPN.

We are having issues troubleshooting what we believe to be a NRPT issue.

NRPT rules are being deployed as part of our VPN config via Microsoft Intune and we can confirm the rules are being received by running the following command on the client.

Get-DnsClientNrptRule

#example output from Get-DnsClientNrptRule
Name : VPN Connection
Version : 2
Namespace : {.service.sec.private}
DirectAccessEnabled : False
NameServers : {10.99.10.10,10.99,11.10}
DnsSecEnabled : False
NameEncoding : Disable

However we are not seeing any settings configured when running the following command after the vpn has connected.

Get-DnsClientNrptPolicy

We have confirmed that connectivity is not an issue as we are able to perform an nslookup against the NRPT namespace when specifying the configured DNS Server

nslookup service.sec.private 10.99.10.10
Server: ip-10-99-10-10-.xxxxx
Address: 10.99.10.10

Non-authoritative Answer
Name:  service.sec.private 
Addresses: 10.200.9.157

Is this correct that "Get-DnsClientNrptPolicy" being blank is indicative of a non active NRPT? how do we troubleshoot why the NRPT is not being applied? 

Thanks