What is System Restore?
System Restore undoes recent changes to Windows itself. When a driver, update, program install or settings change leaves a PC unstable, you apply an earlier restore point and Windows puts its protected system files, registry, drivers and installed programs back the way they were at that moment. It never restores or deletes personal files.
What it changes and what it leaves alone
| Rolled back | Not touched |
|---|---|
| Windows system files | Documents, photos, music, videos and other files in user folders |
| The registry | Email data files |
| Device drivers | Downloads and files saved on the desktop |
| Programs installed or removed since the point | Personal files already deleted, which it cannot bring back |
Because installed programs are part of the snapshot, any app installed after the chosen point is removed and must be reinstalled. The wizard's Scan for affected programs link lists the programs and drivers that will be removed or brought back, so check it and warn the user.
Running System Restore
- From Windows: run
rstrui, or open the System Protection tab of System Properties (SystemPropertiesProtection) and click System Restore. Pick a point, scan for affected programs and confirm. The PC restarts to apply the point and reports the result at the next sign-in. - When Windows will not start: open the Windows Recovery Environment (Shift+Restart, two failed boots in a row, or installation media and Repair your computer), then Troubleshoot > Advanced options > System Restore.
- From Safe Mode when a normal boot crashes before you can run the wizard.
A restore run inside normal Windows creates its own restore point first, so you can choose Undo System Restore afterward. A restore run from Safe Mode or the recovery environment cannot be undone.
Common problems
- No restore points listed: System Protection was off for the system drive (some installations ship with it off), the disk space allocated to it was too small, or old points were purged.
- "System Restore did not complete successfully": real-time antivirus can block files as they are restored. Try again from Safe Mode or the recovery environment.
- Malware returns after a restore: a point created while the PC was infected can hold infected files. Malware cleanup therefore turns System Protection off to purge old points, then turns it back on and creates a clean point once the PC is clean.
Picking the right rollback
System Restore is a broad tool. When one device broke after a driver update, Roll Back Driver in Device Manager is narrower. When trouble began right after a monthly update, uninstall that update (Settings > Windows Update > Update history > Uninstall updates, or Uninstall Updates in the recovery environment). Use System Restore when the cause is unclear or several things changed. If no restore point helps, the next steps are a repair installation, then Reset this PC, then reimaging, each of which loses more.
System Restore is not a backup. It cannot recover a deleted or corrupted document, and its restore points live on the same drive as Windows, so a failed drive takes them too.
System Restore on the CompTIA A+ exam
System Restore is one of the recovery options for the Windows troubleshooting scenarios in Core 2 (220-1202) objective 3.1. Know the rstrui command, where it sits in the recovery environment, what it does and does not change, and that it only works if a restore point exists. Cues: the PC became unstable after new software or a driver and the user's files must be kept, think System Restore; the user deleted a file, think backup or File History, not System Restore; the question asks for the least destructive fix, pick the narrowest rollback that matches the change.