I'd do it with a gpo instead
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn....
I did that in the past and it worked ok