Re the rollback comments at 43mins, we have tested two Microsoft Surface Laptop 3s so far. The new Secure Boot certificates have bricked them both (stuck in a loop on the black/white MS logo start-up screen). UEFI is locked down by Intune managed DFCI policy, so we cannot temporarily disable SB to get them to boot. We have 500+ of these in our environment. We have logged a MS support ticket for this issue, but hold no hope as our other SB support ticket for the Intune policy issue, which we logged 6+ weeks ago, hasn't been responded to yet.