> It was working like that before, but on latest updates it automatically turns on every restart (or so).

that's if you disable through the normal settings interface. the group policy settings stick, although you might have to turn off "tamper protection" first before applying the group policy.