I just tried to point out that doing it the way I specified doesn't require GPO, therefore it works after the GPO is applied and can't run too early. This way works the way it was intended.