System Restore is the Windows recovery feature that rolls the system configuration back to an earlier restore point. It reverts system files, the registry, drivers and installed programs to the state they had when the restore point was created, while leaving personal documents, photos and other user data untouched.
Within Windows updates and recovery, System Restore is the lightest form of rollback: it is designed to undo a problematic driver, update or program installation in minutes, without reinstalling Windows. It is not a backup, and it cannot recover deleted files or a failed disk.
How System Restore works
System Restore relies on the Volume Shadow Copy Service (VSS), which records block-level snapshots of an NTFS volume. When a restore point is created, VSS starts tracking changes, and the original data of modified blocks is preserved in a hidden shadow storage area in the System Volume Information folder. A restore point also stores a copy of the registry and metadata about the triggering event.
During a restore, Windows uses these snapshots to replace protected system files, registry hives and program files with their earlier versions, then restarts. Before the restore begins, Windows normally creates a new restore point, so a restore performed from within a running Windows session can itself be undone.
The scope of a restore is easy to misunderstand. The following table shows what is and is not affected.
| Item | Reverted by a restore | Comment |
|---|---|---|
| Registry and system settings | Yes | Includes services and startup configuration |
| Device drivers | Yes | Common reason to use a restore |
| Installed programs and updates | Yes | Programs installed later are removed or broken |
| Personal documents and photos | No | Not protected and not recovered |
| User passwords | Partly | Recent password changes may be reverted |
| Data on other drives | Only if protection is on for them | Protection is configured per drive |
Restore points and their settings
Restore points are created automatically before significant system changes, such as Windows Update installations, driver installations and many program installers, and can also be created manually at any time. Windows limits automatic and scripted creation to about one restore point every 24 hours by default, so frequent changes within a day may share a single point.
System protection must be enabled for each drive, and on many new installations of Windows 10 and Windows 11 it is turned off by default. The settings are in the System Properties dialog on the System Protection tab, which is opened with SystemPropertiesProtection.exe. The key parameters are listed below.
| Parameter | Typical value | Effect |
|---|---|---|
| Protection status | On for the system drive, if enabled | No restore points without it |
| Maximum disk usage | About 3 to 10 percent of the drive | Controls how many points fit |
| Creation frequency limit | One point per 24 hours | Prevents excessive points from scripts |
| Retention | Until space is needed | Oldest points are deleted first |
| Manual creation | Create button or Checkpoint-Computer | Useful before risky changes |
Restore points are also often deleted by feature updates and by disk cleanup operations, so an old point should never be assumed to exist.
System Restore compared with other recovery options
Windows offers several recovery tools that differ in scope, speed and data impact. System Restore is the right first choice when a system change caused the problem and Windows still starts or the recovery environment is reachable.
| Tool | What it fixes | Effect on personal files |
|---|---|---|
| System Restore | Bad drivers, updates, programs, registry changes | Kept |
| Uninstall updates | A specific recent quality or feature update | Kept |
| Startup Repair | Boot configuration and startup files | Kept |
| Reset this PC | Deep corruption of Windows | Kept or removed, by choice; apps removed |
| System image backup | Total failure, disk replacement | Restored to image state |
| File History or file backup | Lost or changed documents | Restores files only |
Running a restore and troubleshooting it
From a working Windows session, a restore is started with rstrui.exe or through Control Panel recovery options. If Windows no longer starts, the same function is available in the Windows Recovery Environment under Troubleshoot and Advanced options, which can also be reached from a recovery drive or installation media. A restore started from the recovery environment cannot be undone in the same way.
Before confirming, the wizard can scan for affected programs, listing applications and drivers that will be removed or restored. Reviewing that list prevents surprises such as a missing application after the restart.
| Symptom | Likely cause | Response |
|---|---|---|
| No restore points available | Protection disabled or points deleted | Enable protection and create points regularly |
| Restore did not complete successfully | Antivirus interference or file locks | Retry from Safe Mode or the recovery environment |
| Program fails after restore | Program installed after the restore point | Reinstall the program |
| Problem returns after restore | Update reinstalled automatically | Pause updates or hide the faulty update |
Limitations and misconceptions
- System Restore is not a backup: it shares the same disk, so a disk failure destroys the restore points too.
- It does not reliably remove malware, because infections may hide in user folders or survive the rollback.
- It does not recover deleted documents; a file backup is needed for that.
- Shadow copies can be deleted by ransomware, which is why offline or cloud backups remain essential.
Put simply
System Restore works like an undo button for Windows settings. Before major changes, Windows takes a snapshot of its own important parts. If a new driver or update causes trouble, you can go back to the snapshot from before the change.
Your letters, photos and other files stay as they are. That is helpful, but it also means System Restore cannot bring back a file you deleted. For that, you need a real backup on another drive or in the cloud.
In practice
An office worker installs a new printer driver supplied on a vendor website. After the restart, the laptop shows a blue screen during startup every second boot. Windows had automatically created a restore point before the driver installation an hour earlier.
The worker opens the Windows Recovery Environment, chooses System Restore and selects that point. After about fifteen minutes, the laptop restarts normally with the previous driver back in place and all documents unchanged. The IT team then installs the printer through the driver offered by Windows Update, and the laptop remains stable without data loss.