so FYI i've managed to deploy to about just about shy of 200 windows server hosts - actually largely painlessly for now i've setup appropriate Attack Surface Reduction rule exclusions via Intune/Defender config and its solving my issues