Surface Uefi Enable Boot Configuration Lock, Turn off the Surface Hub.