what about AVDs?  can they be added to the configure policy for secure enable?  we this a few weeks ago and a few devices got blue screens related to the policy.  What about surface hubs?  should both be handled separately and not through the policy?  Please advise, thank you