HP Sure Recover

About HP Sure Recover

HP Sure Recover is a firmware level recovery feature built into select HP business PCs. It reinstalls the operating system from a repository the machine reaches at boot, rather than from a recovery partition sitting on the same drive it is trying to repair. That distinction is the point of the product. Ransomware, a failed update or a corrupted partition can take the local recovery copy with it, and a repair tool that lives on the damaged disk goes down with it. Sure Recover sits inside HP Wolf Security, the name HP uses for the protections it builds into the hardware and firmware of its commercial machines, alongside Sure Start for the BIOS and Sure Click for browser isolation. It is not a backup product, it is not an antivirus product, and it is not sold on its own. It arrives as part of the firmware on qualifying HP commercial PCs, and an IT team either leaves it pointed at HP's own image or points it at one the organisation builds and signs itself.

How does HP Sure Recover restore a machine?

Recovery starts in one of three ways. A person at the keyboard presses f11 while the HP logo is on screen after power on. The machine starts recovery on its own when it finds no operating system to boot. Or an administrator sets it to run on a schedule, which HP suggests for public facing machines such as kiosks where periodic wiping is cheaper than investigating.

Whatever the trigger, the sequence is the same. Policies for the feature are held by the HP Endpoint Security Controller in isolated, non volatile memory, separate from the drive and from the operating system, and are deployed through the BIOS. The machine then fetches two things from the repository it has been pointed at: an agent image, which is a WinRE runtime, and the operating system image itself. Both carry signed manifests so the firmware can confirm nothing has been altered in transit. The image is then written to the internal drive.

For the network path, HP is specific about the requirement: Windows 11 and an open network connection, over an HP Ethernet port or adapter. Wi-Fi recovery is available on some PCs only, so a fleet plan that assumes wireless recovery everywhere will find gaps.

What is Embedded Reimaging, and when does it matter?

Some HP machines ship with extra storage on the motherboard, hardware isolated from the operating system, holding a recovery image locally. HP calls this Embedded Reimaging, and it changes two things. The machine can rebuild itself with no network at all, which matters for a laptop that fails away from an office, and recovery finishes faster because nothing has to be downloaded.

It is an option on some models rather than a feature of the whole range, so it has to be confirmed per machine before anyone plans around it. HP's own client management library exposes a query for exactly this, which is a fair signal that HP expects administrators to check rather than assume.

One caution HP prints itself is worth repeating. Because there is no secure erase for that embedded store, a custom image placed there should not carry credentials or other secrets.

What has to be in place before it works

Sure Recover is not something a helpdesk turns on the afternoon it is needed. HP Secure Platform Management has to be provisioned on the machine first. If an organisation wants its own image rather than HP's factory one, that image is built with the Windows Assessment and Deployment Kit in WIM format, published to a repository the machine can reach, and signed, with the matching X.509 public keys provisioned to the firmware so the signature can be checked.

HP provides two routes for the configuration work: the HP Client Management Script Library for scripted and cloud managed environments, and the HP Manageability Integration Kit for teams working through Microsoft management tooling. Either way the setup is a project rather than a checkbox, and it is worth doing before an incident rather than during one.

What running it actually costs you

This is the part a buyer should read twice. HP states it plainly in the administrator guide: the imaging process reformats the drive and removes all data on it, and important files should be backed up before Sure Recover is used.

So the tool restores a machine, not a person's work. In an organisation where documents live in a synced service or on a file server, that is close to painless and the machine is back on the domain in under an hour. In an organisation where people keep things on the desktop, running Sure Recover is the moment those things are gone. The feature is worth buying in proportion to how well the rest of the environment already handles user data.

Who should look at something else

Anyone whose problem is a lost file or a bad update rather than a compromised machine. Sure Recover has one setting, which is rebuild the whole thing. A file level backup product, or Windows system restore, answers a smaller question at a much smaller cost.

Anyone running a mixed fleet. This is firmware on HP commercial hardware, so it does nothing for the Dell and Lenovo machines beside them, and a recovery process that only covers part of an estate still needs a second process for the rest.

Anyone with unusual storage. HP's own documentation notes machines with multiple internal drives, or with Intel Optane, as cases the feature does not cover.

Home and small office buyers on consumer HP models. This is a commercial line feature, and a household is better served by an external drive and a backup service than by a firmware feature it will use once.

And anyone hoping this replaces endpoint protection. Sure Recover is what happens after something got through. It says nothing about stopping it.