gpo: Test certificate policy without NDES