This policy is designed to sit at the root of the domain and contains rules that apply to all domain members. If policy inheritance is blocked on the device OU (as per PAW documentation) this policy needs to be added to the device OU and should be last in the link order.