System Restore enables administrators to restore their computers to a previous state without losing personal data files (e.g. Word documents, graphic files, e-mail). System Restore actively monitors system file changes and some application file changes to record or store previous versions before the changes occurred. Users never have to think about taking system snapshots as System Restore automatically creates easily identifiable restore points, which the users can use to revert to a previous time. Restore points are created at the time of significant system events (such as application or driver install) and periodically (each day). Additionally, users can create and name their own restore points at any time. For more information, please see the System Restore document on TechNet.

System Restore is available in Microsoft® Windows® Millennium (Me) and the Microsoft Windows XP (Home and Professional) operating systems. However, this FAQ addresses questions and issues with System Restore in Windows XP only.

System Restore monitors only a core set of specified system and application file types (e.g. .exe, .dll etc), while Backup Utility typically backs up all files including users personal data files, ensuring a safe copy stored either on the local disk or to another medium. System Restore does not monitor changes to or recover users' personal data files such as documents, graphics, e-mail, and so on. While system data contained in restore points are available to restore to for only a limited period (restore points older than 90 days are deleted by default), backups made by the Backup Utility can be recovered at any time.

System Restore is enabled by default and runs after the successful completion of either the Windows XP Professional or Personal x86-version installation. It requires a minimum of 200 MB of free space available on the system partition. If 200 MB is not available, System Restore will install disabled and will enable itself automatically once the required disk space is available.

With System Restore, you also never have to worry about taking system snapshots, as it will automatically create easily identifiable restore points, which allows you to revert to a previous time. Restore points are created at the time of significant system events (such as application or driver install) and periodically (each day). Additionally, you can create and name your own restore points at any time. You also never have to worry about System Restore filling up your hard drive with these restore points. By default, it only uses a maximum of 12% disk capacity and has an automatic restore point space management feature that purges the oldest restore points to make room for new ones, enabling recovery from any recent undesirable changes.

System Restore does not cause any noticeable performance impact when monitoring your computer. The creation of a Restore point also is a very fast process and usually takes only a few seconds. Scheduled System Checkpoints (every 24 hours by default) are created only at system idle time to avoid interfering with a computer during use.

Only users with administrative rights can use System Restore to restore and adjust System Restore settings. However, the creation of automatic restore points (system checkpoints or event-driven restore points) on the computer takes place regardless of which user is logged onto the computer. If a non-admin user is logged on, system checkpoints or event driven checkpoints will still be created on that computer to ensure protection. However, only a user with admin privileges will be able to restore the computer.

System Restore does not monitor changes to or recover personal data files such as Word documents, graphics, e-mail, etc.

System Restore monitors only a core set of specified system and application file types (e.g. .exe, .dll etc), archiving the states of these files before system changes are made. System Restore does not monitor any user/personal data files. To view the included files specified in System Restore, see Monitored File Extensions in the System Restore section of the Platform SDK. Modifications to this list from sources other than Microsoft are not supported.

See below.

Passwords Not Restored

Restored Passwords

System Restore does not completely uninstall any program if restoring to a point prior to the program installation. As System Restore is based on an inclusionary model, any files added or modified by the installation (which is not monitored by System Restore) or added to or modified in a non-monitored drive will not be tracked. To remove all changes an installation may have made to the system, the user should first use the Add/Remove option in the control panel to remove the application prior to using System Restore. System Restore will undo all recorded changes made to the registry and monitored files caused by the application install, including:

Please see below.

Restored:

Not restored:

As System Restore monitors a core set of specified system and application file types, any downloaded or saved file which has an extension type monitored by System Restore (e.g. .exe, .dlls) and stored on a monitored drive will be lost if restoring to a point prior to the download or save. If you do not want to lose files with a monitored extension due to a restore, you should move these files to the My Documents folder or to a non-monitored partition not restored during a restore process. If you have unknowingly deleted some files due to a restore on your system, you can always recover them by undoing the restore process in question.

The user can manually create a restore point at any time on their computer using the System Restore Wizard. Restore Points are also automatically created on your computer when:

No. System Restore is change base tracking tool, not an imaging or backup tool. Each restore point only stores changes to the system since the creation of the previous restore point to minimize space usage and improve performance, and all restore points are associated. Therefore, restoring the computer from the current state to a previous state requires the availability of all restore points. For example, if a user wants to restore the computer from point D to point A, System Restore will evaluate the system change logs for points C, B, and A.

If a restore point is permanent, space usage for storing the complete chain of restore points since the creation of the permanent restore point would become very large and impractical. System Restore also provides a space management feature to purge old restore points to make room for new ones, creating a rolling safety net. Restore points over 90 days are purged automatically by default.

If an improper shutdown occurs, there is a small possibility that a restore could fail because System Restore may not have logged some file operations properly at the time of shutdown. If the restore fails, the system will be in the same state as before the restore was initiated.

Disk space used by System Restore by default:

The data store size is not a reserved space on the disk and the maximum size (to the max values defined above) is limited at any time by the amount of free space available on disk. Therefore, if disk space use encroaches on the data store size, System Restore always yields its data store space to the system. For example, if the data store size is configured to 500 MB, of which 200 MB is already used, and the current free hard-disk space is only 150 MB, the effective size of the data store is 350 MB (200 + 150), not 500 MB. Note that disk space usage can be adjusted at any time.

Yes. System Restore parameters are configurable remotely or locally by using a Windows Management Instrumentation (WMI) script. A WMI script can also be used to create restore points, list them, select a restore point to restore to, and view the status of a restore operation.

The service pack provides several security and bug fixes for the Windows XP operating system including those for System Restore. Highlights of the key fixes for System Restore in the service pack include:

The Microsoft System Restore team supports users in the Microsoft public newsgroups (please visit Public.WindowsXP.perform_maintain and Microsoft.Public.WindowsXP.help_and_support) and encourages user feedback regarding the effectiveness of Windows XP Service Pack 1.

No. All previous restore points can be restored after the installation.

System Restore protects critical system and application files by monitoring, recording, and in some cases copying these files before they are modified. For example, when an upgrade, an inadvertent user change, a driver install, or a virus modifies a critical system or application file, System Restore records and saves a copy of the file before the change occurs. In the event of a problem, a restore operation can replace files with previously saved versions. Anti-virus utilities, through auto-detection or scanning, monitor critical and personal files on the system for signs of infection, and then take action to remove or isolate ("quarantine") files impacted by known virus types. System Restore also tracks an anti-virus utility when it modifies (cleans), moves, or deletes a monitored, critical, system or application file types.

During a restore process, an active anti-virus utility scans for infected files. If any infected files are detected, the anti-virus utility will attempt to modify, move, or delete them. If the files are successfully cleaned, System Restore will restore the files in question. However, if a file cannot be cleaned and is deleted or "quarantined" (isolated), the restore fails as these actions to the file result in an inconsistent restore state. System Restore will then revert to the state immediately prior to the restore operation.

It is important to note that as viruses become known and definition or signature files for anti-virus utilities are dynamically updated, a restore that failed days before could succeed later on, once the anti-virus utility is updated. Conversely, restoring to a point that succeeded before, if undone and attempted again, could possibly fail if a new signature or definition enables the detection of a virus on a backed up file that cannot be cleaned.

Select Start, Control Panel, and double-click the System icon. Next:

To disable monitoring a particular drive, click Start followed by Control Panel and double click the System icon. Then click on the System Restore tab on the System dialog box. Depending on your disk setup, do the following:

Select Start, then Control Panel and double-click the System icon. Then click on the System Restore tab on the dialog box. Depending on your disk setup, do the following:

To determine the amount of space System Restore is using:

You can either delete all restore points except the latest one, or all the restore points.

Windows Management Instrumentation (WMI) scripts can be used to locally or remotely create or list restore points, select a restore point to restore to, view the status of a restore operation, and adjust system restore parameters.

Please refer to the System Restore Scripting Samples document, which lists functions and parameter descriptions along with script samples provided as a guide to administrators who need local or remote access to the System Restore features and settings.

You can perform a remote system restore using Windows Management Instrumentation (WMI) scripts.

Try the following steps:

Suspension can occur if:

This event usually occurs when the Windows path is corrupt. To resolve this issue, begin by installing Windows XP Service Pack 1. Alternatively, you can temporarily address this issue by copying the framedyn.dll file from the \windows\system32\wbem directory to the \windows\system32 directory.

Typical reasons why checkpoints are not being created:

If no free disk space on monitored system drive or on any of the available non-system drives exists, System Restore will purge restore points consistently across all monitored partitions to free disk space. If the free disk space falls below 50 MB on any monitored partition, System Restore will stop monitoring and suspend.

Note: Some users have reported that using the Real Player One utility has deleted restore points. Please review your System Event Viewer log for System Restore events for a volume error event. For more information, please visit the Microsoft.Public.WindowsXP.perform_maintain and Microsoft.Public.WindowsXP.help_and_support.

This can occur if the file association for Hypertext Markup Language (HTML) component (.htc) files is not in the registry. Please see Windows XP Service Pack 1 for more information.

This can occur if the event log service is disabled on the computer. The user should enable the event log service and then try to create the restore point. To verify that the service is working:

If you restore to a point before the Remote Assistance Ticket creation, the HelpAssistant account password is automatically reset. The HelpAssistant account is the account that an administrator uses to log on and connect to a computer. This issue has been resolved in Windows XP Service Pack 1. If the service pack is unavailable, use Remote Assistance to create another ticket.

First, run SRDiag.exe found in Windows XP Service Pack 1 to capture the System Restore change, restore logs, and create a .cab file. This is a precautionary step, and you can e-mail the logs in a .cab file to a monitored alias to Microsoft for troubleshooting if one of the suggestions listed below does not resolve the issue.

Possible causes for restore point failures:

Be sure signature/definitions are current. Ensure your AV utility is configured to exclude the SVI directory

If the System Volume Information (SVI) folder is on a FAT partition and a virus infected file has been detected or copied to the data store before it was cleaned, the data store needs to be purged to remove the Restore Point with the infected file.

To do this, the user should disable and then re-enable System Restore monitoring on that particular drive as specified in a previous entry in this FAQ, "How can I disable System Restore from monitoring a particular drive?" under the How-to Guide section.

If the System Volume Information Folder is on an NTFS partition, the SVI directory can be accessed by a virus utility to clean an infected file as any other part of the file system.

To generate a system restore Cab file:

To check event logs:

This problem often occurs if you convert the disk from a basic disk to a dynamic disk.

The image displayed on the desktop is a common image file and therefore not monitored by System Restore. System Restore does not restore common image files, as they could compromise the security of personal data.

By design, System Restore does not record changes in compression, nor does it undo them, as changes in compression do not cause the system to fail.

Setup overwrites the existing settings so that System Restore is enabled after installation. In operating systems in which System Restore is not included, such as Microsoft Windows 95, Microsoft Windows 98, Microsoft Windows NT Workstation, or Microsoft Windows 2000 Professional, System Restore will also be enabled by default on all drives.

To verify that System Restore services are running:

To verify that Windows Management Instrumentation Service is running:

To verify that Task Scheduler is running:

To generate a System Restore Services .cab file:

Windows hides all system files and files marked hidden by default. To view these files:

First, confirm that all signature/definitions are current and ensure your anti-virus utility is configured to exclude the Smart Virtual Instruments (SVI) directory. If you suspect previous restore points contain copies of infected monitored files that your anti-virus utility was unable to clean, you can remove these, and all related restore points from the System Restore archive by disabling than re-enabling System Restore. (Note: Disabling System Restore will remove all restore points. Enabling System Restore will resume the creation of new restore points as schedule and events require).

To disable System Restore, click on Start, Control Panel, Performance and Maintenance, and then System Applet, and follow the steps below:

It is possible to restore a computer to a previously infected point by disabling the associated anti-virus utility, and once the restore is complete, re-enabling the utility to detect and take action on the restored state to remove infected files. (Note: turning off anti-virus protection is not recommended under most conditions, and should be done only temporarily to restore the system). Before disabling an anti-virus utility on a computer, it should be disconnected from any network to prevent the risk of infection.

To restore a computer to a previously infected restore point:

For System Restore architecture, please see the MSDN white paper Microsoft Windows XP System Restore. For SDK information, see the white paper SDK document System Restore.