the security in place on a GPO... if in the GPO interface.
I don't care what security you place in a GPO, if I(anyone) has access to the registry, that can be changed.
Of course once the policy is refreshed, it will change back, but the point is, the security model is only effective when the policy object gets 'compiled' and applied to the machine/user
