What is a restore point?
A restore point records the state of Windows' configuration at one moment so that System Restore can return to it later. It covers protected system files, the registry, device drivers and installed programs. It does not contain personal files, so it is a configuration checkpoint, not a backup.
Where restore points come from
Restore points exist only on drives where System Protection is turned on. Windows then creates them automatically before many events that could break something: installing software through Windows Installer, installing some device drivers and installing Windows updates. Automatic points are not guaranteed. Some installers never request one, and Windows limits how often points are made, so two installs close together may share a single point. A careful technician creates a point by hand before any risky change.
Creating a restore point manually
- Search Start for Create a restore point, or run
SystemPropertiesProtection. Either opens the System Protection tab of System Properties. - Check that Protection shows On for the system drive, usually C:.
- Click Create, type a clear description such as "Before printer driver 5.2" and click Create. The description is what you will see in the restore wizard later.
In Windows PowerShell 5.1, run as administrator, Checkpoint-Computer -Description "Before registry edit" creates a point and Enable-ComputerRestore -Drive "C:\" turns protection on. By default Checkpoint-Computer will not create more than one point in 24 hours. These cmdlets are not part of PowerShell 7.
Configuring System Protection
- Protection is set per drive. Select a drive and click Configure to turn it on or off. Protecting a data-only drive adds little, because restore points do not cover personal files.
- The Max Usage slider limits how much of the drive restore points may use. When that space fills, Windows deletes the oldest points to make room, so a small allocation may keep only one or two recent points.
- The Delete button on the same page removes every restore point for that drive.
- Restore points are built on the Volume Shadow Copy Service, require an NTFS volume and are stored in the hidden System Volume Information folder on each protected drive.
vssadmin list shadowstorageshows how much space they use.
Some Windows 10 and 11 installations ship with protection turned off, so check it during setup instead of assuming points exist. Disk Cleanup can also delete all but the most recent point to free space.
Restore points and malware
A point created while a PC was infected can contain infected files, and applying it later can bring the infection back. That is why malware cleanup includes turning System Protection off, which deletes the existing points, and then, once the system is clean, turning it back on and creating a fresh point.
Restore point vs. backup
| Restore point | Backup (File History, image, cloud) | |
|---|---|---|
| Contents | System files, registry, drivers, programs | Personal files; an image backup also holds the whole system |
| Location | The same drive it protects | Separate media or the cloud |
| Retention | Oldest points deleted automatically when space runs out | Set by the backup schedule and retention settings |
| Survives a failed drive | No | Yes, when stored elsewhere |
Restore point on the CompTIA A+ exam
Restore points support the System Restore recovery step in the Windows troubleshooting scenarios of Core 2 (220-1202) objective 3.1. Know how they are created (automatically before installs and updates, manually on the System Protection tab), that protection is set per drive with a space limit, and that points never include personal files. Cues: System Restore shows no points, think protection disabled or points purged; you are about to install an unsigned driver or edit the registry, create a restore point first.