[Head416]

I've deployed a handful. Also treated them like laptops and joined to the domain getting the same GPOs as laptops. No real hard-core lockdown policies in my case though.

To me, the advantage of the surface is that it IS a real laptop. It has the full functionality to run all the same applications, use your AD accounts, AD integrated apps, etc. If you don't treat it like a laptop you lose the functionality that allows it to be a laptop replacement.