1. When we set the CSP as

(a) HighConfidenceOptOut = Disable

(b) MicrosoftUpdateManagedOptin = Enable

(c) AvailableUpdates = Enable, When the

certificate deployment starts? provided device has latest firmware and patch (meeting requirement for secure boot)?

Am I correct in assuming that the default db will only be updated by an OEM's BIOS update? In other words, Microsoft updates would only update the Active db, and never the default. Follow up question: What is the risk of not updating the default db when the active db is up to date?

Aside from creating the intune configuration, is there a way to report success or readiness

so if you are saying that you are looking after the consumer updates so they dont need to worry about the cert? why as organization with 6k machines I need to do anything ? thanks  

So the cert is already on OS this is a plan to make sure that it will be deployed properly to the bios? 

have we got event id' to validate if all the default certs have been updated and not just current.

What is Microsoft's recommendation for managing firmware on Surface devices for customers using WUfB?

Assuming from an effort perspective that Enabling Driver Update policies is better than custom SCCM deployments.

Can you clarify what needs to be done to a MECM environment to prepare for this?

can you give instruction on the boot medium, that boot with 2011 keys and can upgrade the new boot manager in the case that windows does not start anymore, because the new keys in db are reset to 2011?

How does a large enterprise confirm/validate that their machines in their fleet have the certs in place and activated?  Specifically, if they are mixed with some SCCM and some Intune?  It is a manufacturing company with the plants still on SCCM/WSUS vs Corporate/Windows Update for Business.

So is the general advise

If you have a common Dell, Lenovo, Sufrace device you 'should' be fine just to make sure the UEFI / BIOS is up to date, and then leave it for Microsoft to update the certificate on the client via CFR? 

If you have some wacky bit of hardware, like custom built gaming pc, odd meetingroom system, then you might need to manually add the reg key manually to tag it as a known good system?