Backing Up and Recovering System State Using System Restore
Restore points can be used to recover systems that are experiencing
problems after a system update, software installation, hardware
installation, or other change. The following sections discuss how
restore points can be created manually and how systems can be recovered
using restore points. Restore operations are reversible in most cases.
Understanding Restore Points
System Restore monitors the operating system
for changes and creates restore points at regular daily intervals
before changes are introduced. The feature works by saving a snapshot
of a computer’s system configuration and writing the snapshot to disk
so that it can be used to recover the system to a specific point in
time if necessary. It is important to note that System Restore does not
affect personal data. You can recover a system to a restore point
without affecting a user’s application data, cached files, or
documents. System Restore doesn’t write any information to the
Documents folder either.
System Restore tracks and saves configuration information
separately for each drive on a computer. This means that each drive has
disk space made available to System Restore, and you can turn off
monitoring of individual drives as needed. If a drive is configured for
System Restore monitoring, you can recover from changes if a problem
occurs. If a drive isn’t configured for System Restore monitoring,
configuration changes are not tracked, and changes cannot be recovered
if a problem occurs. On most systems, you should configure System
Restore for the system drive, which stores the operating system files,
and for all drives containing critical applications.
Restore points can be restored in one of three ways: by checkpoint,
by date, or by event. Individual snapshots scheduled by the operating
system are called system checkpoints.
Normal system checkpoints are made approximately every 24 hours. If a
computer is turned off when a daily checkpoint is scheduled, System
Restore creates the checkpoint the next time the computer is started.
Note
Although earlier releases of Windows created an initial snapshot
when you install the operating system, an initial snapshot normally is
not created when you install Windows 8. The reason for this is that PC
Refresh and PC Reset are available as options to get the computer back
to its original state.
When System Restore is enabled, some snapshots are created
automatically based on events that the operating system triggers when
you make changes or install applications. For simplicity, I call these
snapshots installation restore points, and there’s actually a group of them, each with a different purpose. The event-based snapshots are as follows:
-
Program name installation restore points
Created prior to installing a program that uses a compatible installer.
You can use installation restore points to track application
installation and to restore a computer to the state it was in before
the application was installed. Restoring the computer state means that
all file and registry settings for the installed program are removed.
It also means that programs and system files altered by the
installation are restored to their previous state. Once completed, the
program won’t work, and you’ll need to reinstall it if the user wants
to use it again.
Caution
These are called program name installation restore points instead of program uninstall restore points
for a very good reason. The restore process doesn’t uninstall all the
application files. It removes file and registry settings that might
affect the operation of the computer. To completely uninstall a
program, you need to use the Programs tool in Control Panel.
-
Automatic update restore points
Created prior to applying an automatic update. If a computer has
problems after applying an automatic update, you can use the restore
point to recover the computer to its previous state. (You can also use
the Programs tool to remove automatic updates.)
-
Restore operation restore points
Created prior to restoring a computer. If you find that you used the
wrong restore point or that the restore point doesn’t work, you can use
these restore points to undo the restore operation and recover the
computer to the state it was in before you reversed the previous
settings.
-
Unsigned device driver restore points
Created prior to the installation of an unsigned or uncertified driver
on a computer. If a computer has problems after installing an unsigned
or uncertified driver, you can use these restore points to restore the
computer to its state before you installed the driver. For signed and
certified drivers, the normal rollback procedure should allow you to go
back to the previous driver being used.
-
Microsoft Backup tool recovery restore points
Created prior to recovering files or system data by using the Backup
tool. If the recovery fails or if the computer doesn’t work properly
after the recovery, you can undo the changes and restore the computer
to its previous state.
Users can also create snapshots manually. These snapshots are called manual restore points. You should recommend that users create snapshots prior to performing any operation that could cause problems on the system.
You can restore computers when they are running in normal mode or
safe mode. In normal mode, a restore operation restore point is created
prior to restoration of the computer. But in safe mode, the restore
operation restore point is not created because changes you make in safe
mode aren’t tracked and you can’t undo them using restore points.
However, you can use safe mode to restore any previously created
restore point.
Creating Manual Restore Points
You can create a manual restore point by following these steps:
-
In Control Panel, tap or click System And Security, and then tap or click System.
-
In the left pane, tap or click System Protection.
-
Select the disk for which you want to create the restore point, and then tap or click Create.
-
Enter a description for the restore point, such as Prior To Display Monitor Driver Update And Changes. Tap or click Create.
-
When the restore point is created, tap or click OK.
Recovering from Restore Points
To recover a computer from a restore point when the operating system is running, follow these steps:
-
In Control Panel, tap or click System And Security, and then tap or click System.
-
In the left pane, tap or click System Protection and then tap or click System
Restore. System Restore examines the available restore points on the
computer. This process can take several minutes. When it completes,
System Restore recommends a restore point. If you want to determine
what programs the restore operation will affect, tap or click Scan For
Affected Programs.
-
If you want to determine what additional restore points are
available, select Choose A Different Restore Point and then tap or
click Next. Recent restore points are listed by date, time,
description, and type. To see additional restore points that are
available, tap or click Show More Restore Points. To determine what
programs the restore operation will affect when using a particular
restore point, tap or click a restore point and then tap or click Scan
For Affected Programs.
-
Once you’ve selected a restore point or accepted the recommended restore point, tap or click Next to continue.
-
Tap or click Finish. When prompted, tap or click Yes to confirm that
you want to use the selected restore point to restore the computer’s
system files and settings.
To recover a computer from a restore point when the operating system won’t run, follow these steps:
-
If the computer won’t start normally, the Recovery screen is
displayed during startup. On the Recovery screen, tap or click See
Advanced Repair Options, then tap or click Troubleshoot.
-
On the Troubleshoot screen, tap or click Advanced Options and then tap or click System Restore.
-
System Restore examines the available restore points on the
computer. You’ll then be able to select a restore point to use and the
procedure is similar to steps 4 to 7 in the previous procedure.
During the restoration, System Restore shuts down Windows 8. After
restoration is complete, Windows 8 restarts using the settings in
effect at the date and time of the snapshot. After the system restarts,
the System Restore dialog box is displayed again. Read the message
provided, and then tap or click Close. If Windows 8 isn’t working
properly, you can apply a different restore point or reverse the
restore operation by repeating this procedure and selecting the restore
operation that was created prior to applying the current system state.
Troubleshooting System Restore
System Restore isn’t always successful in its recovery attempts. If System
Restore fails to recover the computer to the point in time you are
targeting, you can repeat the restore procedure to try to recover the
computer. This time, select a different restore point.
