We are deploying several Microsoft Surface tablets with Windows 8.1 Enterprise.

How can I lock down the advanced boot options screen and prevent users from refreshing the PC, resetting the PC, system restore, system image recovery, or even booting to a flash drive?

Can this be set in Group Policy?

Hi,

As far as I know, We don't have method to disable System Refresh and Reset by GP, Actually, System Refresh and Reset need admin permission, you can set UAC to notify this thing. Then user will not use this feature.

While you can disable System Restore.

Open GP, Expand Computer Configuration, expand Administrative Templates, expand System, and then click System Restore

In addition, Booting to a flash drive is managed by BIOS. Only we can do is disable USB port instead.