In what order does GFI EndPointSecurity check devices against Protection Policies?