HP Sure Recover Custom Setup – Part 5 – HP Secure Platform Payload Files

Now we need to create the payload files to provision HP Secure Platform, and setup Sure Recover. If you’re already using Sure Admin, then the HP Secure Platform will already be configured, and you’ll just need to create the payload files for Sure Recover. I’m going to be covering the entire process… but I bet eventually you’ll be able to do all of this using HP Connect… just guessing…

Pre-Reqs | GitHub Script Snips

• HPCMSL Installed [Docs]
  • New-HPSecurePlatformEndorsementKeyProvisioningPayload
  • New-HPSecurePlatformSigningKeyProvisioningPayload
  • New-HPSureRecoverImageConfigurationPayload
• URLs for where you placed the Agent & OSImage
  • OS Ex: http://hpsr.blob.core.windows.net/public/OSImages/Win10/Custom.mft
  • Agent Ex: http://hpsr.blob.core.windows.net/public/SRAgent

We’ll be using those commands to build the 4 payload files that will need to be applied to the endpoints.

Pay attention to the version number. Each time you make a change to the payload file, you need to increment the number. When do you change the payload files?

• When you want to CHANGE the URL that Sure Recover uses?
  • This should be VERY rare, and really only on test machines if you’ve planned ahead well
  • Changing the Agent URL for testing custom agents you’ve developed
  • Changing the OS Image URL to test different images
  • If you’ve replaced certificates due to it expiring or because you like to change

Typically, you would just replace the content on the server (azure blob storage) with an updated agent or image, and no change is required on the endpoint. I was just testing many scenarios so I found I had to continue to increment the version, or errors would happen.

So lets run those commands!

Alright, now it’s time to deploy them…

Please NOTE, that making changes to the Secure Platform requires physical presence, the end user WILL be required to accept the change, unless you’ve already disabled physical presence(PPI) in the BIOS… which also required physical presence.

Check back soon for seeing the payloads applied (requires HPCMSL on the endpoint), and watching what happens…

1. Overview
2. HP Connect – Create 2 of the needed certificates.
3. Certs, Manifests & Signatures
4. Azure Blob Storage Container to host your Agent & OS Images
5. Creating your HP Secure Platform Payload files
6. Deploy Payload Files

GARYTOWN