System Restore enables administrators to restore their computers to a previous state without losing personal data files (e.g. Word documents, graphic files, e-mail). System Restore actively monitors system file changes and some application file changes to record or store previous versions before the changes occurred. Users never have to think about taking system snapshots as System Restore automatically creates easily identifiable restore points, which the users can use to revert to a previous time. Restore points are created at the time of significant system events (such as application or driver install) and periodically (each day). Additionally, users can create and name their own restore points at any time. For more information, please see the System Restore document on TechNet.

System Restore is available in Microsoft® Windows® Millennium (Me) and the Microsoft Windows XP (Home and Professional) operating systems. However, this FAQ addresses questions and issues with System Restore in Windows XP only.

System Restore monitors only a core set of specified system and application file types (e.g. .exe, .dll etc), while Backup Utility typically backs up all files including users personal data files, ensuring a safe copy stored either on the local disk or to another medium. System Restore does not monitor changes to or recover users' personal data files such as documents, graphics, e-mail, and so on. While system data contained in restore points are available to restore to for only a limited period (restore points older than 90 days are deleted by default), backups made by the Backup Utility can be recovered at any time.

System Restore is enabled by default and runs after the successful completion of either the Windows XP Professional or Personal x86-version installation. It requires a minimum of 200 MB of free space available on the system partition. If 200 MB is not available, System Restore will install disabled and will enable itself automatically once the required disk space is available.

With System Restore, you also never have to worry about taking system snapshots, as it will automatically create easily identifiable restore points, which allows you to revert to a previous time. Restore points are created at the time of significant system events (such as application or driver install) and periodically (each day). Additionally, you can create and name your own restore points at any time. You also never have to worry about System Restore filling up your hard drive with these restore points. By default, it only uses a maximum of 12% disk capacity and has an automatic restore point space management feature that purges the oldest restore points to make room for new ones, enabling recovery from any recent undesirable changes.

System Restore does not cause any noticeable performance impact when monitoring your computer. The creation of a Restore point also is a very fast process and usually takes only a few seconds. Scheduled System Checkpoints (every 24 hours by default) are created only at system idle time to avoid interfering with a computer during use.

Only users with administrative rights can use System Restore to restore and adjust System Restore settings. However, the creation of automatic restore points (system checkpoints or event-driven restore points) on the computer takes place regardless of which user is logged onto the computer. If a non-admin user is logged on, system checkpoints or event driven checkpoints will still be created on that computer to ensure protection. However, only a user with admin privileges will be able to restore the computer.

System Restore does not monitor changes to or recover personal data files such as Word documents, graphics, e-mail, etc.

System Restore monitors only a core set of specified system and application file types (e.g. .exe, .dll etc), archiving the states of these files before system changes are made. System Restore does not monitor any user/personal data files. To view the included files specified in System Restore, see Monitored File Extensions in the System Restore section of the Platform SDK. Modifications to this list from sources other than Microsoft are not supported.

See below.

Passwords Not Restored

Restored Passwords

System Restore does not completely uninstall any program if restoring to a point prior to the program installation. As System Restore is based on an inclusionary model, any files added or modified by the installation (which is not monitored by System Restore) or added to or modified in a non-monitored drive will not be tracked. To remove all changes an installation may have made to the system, the user should first use the Add/Remove option in the control panel to remove the application prior to using System Restore. System Restore will undo all recorded changes made to the registry and monitored files caused by the application install, including:

Please see below.

Restored:

Not restored:

As System Restore monitors a core set of specified system and application file types, any downloaded or saved file which has an extension type monitored by System Restore (e.g. .exe, .dlls) and stored on a monitored drive will be lost if restoring to a point prior to the download or save. If you do not want to lose files with a monitored extension due to a restore, you should move these files to the My Documents folder or to a non-monitored partition not restored during a restore process. If you have unknowingly deleted some files due to a restore on your system, you can always recover them by undoing the restore process in question.

The user can manually create a restore point at any time on their computer using the System Restore Wizard. Restore Points are also automatically created on your computer when:

No. System Restore is change base tracking tool, not an imaging or backup tool. Each restore point only stores changes to the system since the creation of the previous restore point to minimize space usage and improve performance, and all restore points are associated. Therefore, restoring the computer from the current state to a previous state requires the availability of all restore points. For example, if a user wants to restore the computer from point D to point A, System Restore will evaluate the system change logs for points C, B, and A.

If a restore point is permanent, space usage for storing the complete chain of restore points since the creation of the permanent restore point would become very large and impractical. System Restore also provides a space management feature to purge old restore points to make room for new ones, creating a rolling safety net. Restore points over 90 days are purged automatically by default.

If an improper shutdown occurs, there is a small possibility that a restore could fail because System Restore may not have logged some file operations properly at the time of shutdown. If the restore fails, the system will be in the same state as before the restore was initiated.

Disk space used by System Restore by default:

The data store size is not a reserved space on the disk and the maximum size (to the max values defined above) is limited at any time by the amount of free space available on disk. Therefore, if disk space use encroaches on the data store size, System Restore always yields its data store space to the system. For example, if the data store size is configured to 500 MB, of which 200 MB is already used, and the current free hard-disk space is only 150 MB, the effective size of the data store is 350 MB (200 + 150), not 500 MB. Note that disk space usage can be adjusted at any time.

Yes. System Restore parameters are configurable remotely or locally by using a Windows Management Instrumentation (WMI) script. A WMI script can also be used to create restore points, list them, select a restore point to restore to, and view the status of a restore operation.

The service pack provides several security and bug fixes for the Windows XP operating system including those for System Restore. Highlights of the key fixes for System Restore in the service pack include:

The Microsoft System Restore team supports users in the Microsoft public newsgroups (please visit Public.WindowsXP.perform_maintain and Microsoft.Public.WindowsXP.help_and_support) and encourages user feedback regarding the effectiveness of Windows XP Service Pack 1.

No. All previous restore points can be restored after the installation.

System Restore protects critical system and application files by monitoring, recording, and in some cases copying these files before they are modified. For example, when an upgrade, an inadvertent user change, a driver install, or a virus modifies a critical system or application file, System Restore records and saves a copy of the file before the change occurs. In the event of a problem, a restore operation can replace files with previously saved versions. Anti-virus utilities, through auto-detection or scanning, monitor critical and personal files on the system for signs of infection, and then take action to remove or isolate ("quarantine") files impacted by known virus types. System Restore also tracks an anti-virus utility when it modifies (cleans), moves, or deletes a monitored, critical, system or application file types.

During a restore process, an active anti-virus utility scans for infected files. If any infected files are detected, the anti-virus utility will attempt to modify, move, or delete them. If the files are successfully cleaned, System Restore will restore the files in question. However, if a file cannot be cleaned and is deleted or "quarantined" (isolated), the restore fails as these actions to the file result in an inconsistent restore state. System Restore will then revert to the state immediately prior to the restore operation.

It is important to note that as viruses become known and definition or signature files for anti-virus utilities are dynamically updated, a restore that failed days before could succeed later on, once the anti-virus utility is updated. Conversely, restoring to a point that succeeded before, if undone and attempted again, could possibly fail if a new signature or definition enables the detection of a virus on a backed up file that cannot be cleaned.

Select Start, Control Panel, and double-click the System icon. Next:

To disable monitoring a particular drive, click Start followed by Control Panel and double click the System icon. Then click on the System Restore tab on the System dialog box. Depending on your disk setup, do the following:

Select Start, then Control Panel and double-click the System icon. Then click on the System Restore tab on the dialog box. Depending on your disk setup, do the following:

To determine the amount of space System Restore is using:

You can either delete all restore points except the latest one, or all the restore points.

Windows Management Instrumentation (WMI) scripts can be used to locally or remotely create or list restore points, select a restore point to restore to, view the status of a restore operation, and adjust system restore parameters.

Please refer to the System Restore Scripting Samples document, which lists functions and parameter descriptions along with script samples provided as a guide to administrators who need local or remote access to the System Restore features and settings.

You can perform a remote system restore using Windows Management Instrumentation (WMI) scripts.

Try the following steps:

Suspension can occur if:

This event usually occurs when the Windows path is corrupt. To resolve this issue, begin by installing Windows XP Service Pack 1. Alternatively, you can temporarily address this issue by copying the framedyn.dll file from the \windows\system32\wbem directory to the \windows\system32 directory.

Typical reasons why checkpoints are not being created: