Any guidance on older Lenovo ThinkStation devices?  Specifically P330 Tiny and P350 Tiny.  We've updated to the latest BIOS, but they all throw an Access Denied error when attempting to update the KEK.  We've discovered that suspending BitLocker, manually entering BIOS, and loading factory default Secure Boot keys resolves the issue, but we don't have the resources to physically put hands on all these devices.  Are there more updates in the works that will allow these ThinkStations to update the KEK without manual user intervention?