The SEE Device Control policy does not apply to the machine or users if Windows is booted in Safe Mode (with networking).
Safe Mode allows you basic access to the system because it doesn't load any third-party software and drivers. In consequence, the SEE Device Control subsystem is not loaded nor enforced.
This is by design of the operating system. To go around this, you may want to disable Safe Mode.
Warning: Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. For more information on backing up the registry see the following article on the Microsoft support site: