A user installs a new graphics driver, reboots, and the machine blue-screens before the desktop ever appears. Nothing is physically broken, no files are missing, yet Windows won't run. This is exactly the situation System Restore, driver rollback, and update rollback were built for: undoing a bad change to Windows itself without touching the user's documents and without rebuilding the machine. Knowing which rewind tool to reach for, and in what order, separates a five-minute fix from an afternoon of reimaging.
CompTIA A+ Core 2 (220-1202) tests this material in two places at once. The Microsoft Windows operating system features and tools objectives expect you to know what System Restore is, how System Protection is configured, and how restore points are created and applied. The workstation backup and recovery objectives then place restore points inside a larger recovery ladder alongside Reset this PC and full backups. And troubleshooting scenarios love the phrasing "what is the LEAST destructive fix?" — answering those correctly depends on the ladder this article builds.
System Restore rewinds Windows itself, not your personal files
System Restore takes snapshots, called restore points, of the operating system's configuration: protected system files, the Windows registry, installed device drivers, and information about installed programs and updates. When something goes wrong after a change, you apply a restore point and Windows rolls those components back to how they were when the snapshot was taken.
Just as important is what a restore point does not capture. System Restore deliberately ignores personal data: documents, photos, music, email stores, and downloads are neither backed up by a restore point nor deleted or reverted by applying one. If a user deletes a spreadsheet, System Restore cannot bring it back — that job belongs to File History, cloud sync, or a real backup. The exam tests this boundary constantly:
| Restored by System Restore | Not touched by System Restore |
|---|---|
| Windows system files | Documents, photos, music, video |
| The registry (system settings) | Email data files |
| Installed device drivers | Files in Downloads or on the desktop |
| Programs and updates installed after the point | Anything on a drive without protection enabled |
One consequence deserves emphasis. Because installed programs are part of the snapshot, any application installed after the restore point was created will be removed by the restore. The wizard's "Scan for affected programs" link lists exactly which applications and drivers a given point will remove or bring back — use it, and tell the user, because "System Restore uninstalled my new app" is a predictable support call.
For the exam, lock in one sentence: System Restore rolls back system files, registry settings, drivers, and installed programs to an earlier point in time, and it never restores or deletes personal files.
System Protection controls whether restore points exist at all
System Restore only works if System Protection, the underlying feature that creates and stores restore points, is enabled for the volume in question. You configure it from the System Protection tab of System Properties, reachable by searching for "Create a restore point" or by running SystemPropertiesProtection.exe.
Protection is configured per volume. Each drive in the dialog shows protection as On or Off, and in practice you normally enable it only for the system drive, where Windows, the registry, and installed programs live; protecting a data-only drive buys little, since restore points don't cover personal files anyway. The volume must be formatted with NTFS, because System Protection is built on the Volume Shadow Copy Service, which relies on NTFS features — a FAT32 or exFAT volume cannot hold restore points.
Selecting a drive and clicking Configure opens the disk space allocation slider. System Protection reserves a maximum percentage of the volume for restore point storage, typically a low single-digit percentage by default, and the storage behaves like a rolling buffer: when the reserved space fills up, Windows silently deletes the oldest restore points to make room for new ones. That purging matters: a machine with a tiny allocation may only ever hold one or two recent points, useless when the problem started three weeks ago. Raising the slider keeps more history at the cost of disk space, and the same dialog's Delete button wipes all restore points for the drive, which you'll use during malware cleanup.
Here is the note that trips up working technicians: System Restore is switched off by default on some Windows 10 and Windows 11 installations, particularly clean installs, so never assume a customer's PC has restore points waiting. When you set up a workstation, or sit down at an unfamiliar one, verify that System Protection is On for the system drive with a reasonable allocation. An exam question that says "the technician attempts a restore but no restore points are available" is usually pointing at protection disabled, the allocation exhausted, or points purged.
Windows creates restore points automatically, but professionals create them manually
Once protection is on, Windows creates restore points on its own. Automatic triggers include installing an application through a Windows Installer package, installing a device driver, and installing Windows updates. Windows also creates periodic points through the Task Scheduler, making one when the machine sits idle if none has been created recently. The logic is simple: each of those events might break something, so Windows checkpoints the system first.
Automatic triggers are not a guarantee, though. Not every installer registers with the restore point mechanism, and frequency limits mean back-to-back installs may share a single point. That is why a manual restore point before any risky change is a core technician habit. The System Protection tab's Create button makes a point on the spot. Before you edit the registry, install an unsigned driver, or run a vendor tool a customer insists on, spend the thirty seconds to create one and name it clearly, for example "Before NIC driver 3.1.9", because the description is what you'll see in the restore wizard later.
PowerShell can do the same job in scripts and remote sessions: Checkpoint-Computer creates a restore point, and Enable-ComputerRestore turns protection on for a drive. You don't need deep syntax for the exam, but recognizing that these exist on the command line is fair game.
You can run a restore from inside Windows or from the recovery environment
When Windows still boots, run the System Restore wizard with rstrui.exe, or reach it through the System Protection tab. The wizard proposes the most recent point but lets you pick any stored one, shows each point's date and description, and offers the scan for affected programs.