System Restore

System Restore automatically monitors and records key system changes on a user's computer. It is designed to reduce support costs and increase customer satisfaction by enabling a user to undo a change that may have caused a problem with the system, or revert to a day when the system was performing optimally.

Developer Audience

The System Restore API is designed for use by C/C++ programmers. A familiarity with Windows Management Instrumentation (WMI) is required to use the scripting interface.

Runtime Requirements

Applications that use System Restore require Windows® Millennium Edition or Whistler. For information about which operating systems are required to use a particular function, see the Requirements section of the documentation for the function.

See Also

WMI

Overview

An overview of how System Restore works.

Reference

Documentation of System Restore functions, structures, and classes.

Samples

A sample program written in C.

Feedback

Make error reports and feature requests directly to Microsoft.

Microsoft Platform SDK, February 2001 Edition.
This content last built on Thursday, February 01, 2001.


About System Restore

System Restore monitors system changes and saves the system state as a restore point. If a system problem develops as a result of a system change, the user can return the system to a previous state using the data from a restore point.

In addition to creating restore points when system changes occur, System Restore creates restore points every 10 hours of session time and 24 hours of absolute time. In addition, users can create restore points at any time.

System Restore does not restore user data or documents, so it will not cause users to lose their files, e-mail, browsing history, or favorites. System Restore is also made available to users in safe mode, making it easier for them to restore their computers to a state before problems occurred.

For more information, see the following topics:

  • Monitoring the System
  • Restoring the System
  • Restore Points
  • System Restore API


Monitoring the System

System Restore monitors a core set of system and application files, archiving the states of these files before system changes are made. System Restore also saves a full snapshot of the registry and some dynamic system files. When System Restore detects that the user is not actively using the computer, it compresses the registry and any file copies made.

System Restore requires a minimum of 200 MB of free disk space on the system drive at installation. When the amount of free disk space falls below 50 MB on any drive, System Restore switches to standby mode and stops creating restore points. All restore points are deleted at that time. System Restore reactivates and resumes creating restore points as soon as 200 MB of disk space is free on the system drive.

The files that are monitored or excluded from monitoring are specified in the file %windir%\system32\restore\Filelist.xml. For more information, see Monitored File Extensions


Restoring the System

As the computer is used over time, restore points are collected in the data archive without any management or intervention required by the user. If the user ever needs to restore the system to a previous state, the available restore points are made visible to the user through the System Restore user interface. The user can choose any of these restore points. The only way to access this archive of restore points is through the System Restore user interface and the System Restore API; this is to protect data integrity and prevent accidental changes made by the user, applications, or other agents.

To restore a system, System Restore undoes file changes made to monitored files, recapturing the file state at the time of the selected restore point. It then replaces the current registry with the one saved for the selected restore point.

To ensure that your application has the desired behavior after a restore, do the following:

  • Ensure that key application binaries to be protected use extensions consistent with those used in Filelist.xml. For more information, see Monitored File Extensions.
  • Do not use monitored extension types for user-editable files. For example, if you name a user's personal data file using the extension .ini, the user may lose work as a result of a system restore.
  • Do not store information in the registry that prevents user access to personal data files or applications on system restore. Otherwise, you must provide a mechanism by which the user can download and reinstall the applications without having to pay for them again.
  • Use the System Restore API to create meaningful restore points at install and uninstall.


Restore Points

Restore points are created to allow users a choice of previous system states. Each restore point contains the necessary information needed to restore the system to the chosen state. Restore points are created before key changes are made to the system.

System Restore has an automatic restore point space-management feature that purges the oldest restore points to make room for new ones, while still enabling the user to recover from any recent destructive changes. System Restore takes a maximum of 12 percent of the disk space in systems with hard drives over 4 gigabytes (GB), and a maximum of 400 megabytes (MB) for hard drives under 4 GB. To reduce the maximum storage limit use the System application in the Control Panel.

The following describes the triggers that cause System Restore to create a restore point.

Event-triggered restore points

System Restore automatically creates a restore point before the following events:

  • Application installation (provided the application utilizes an installer that is System Restore compliant). If the application install causes system problems, the user can restore the system to a state before the installation of the application.
  • AutoUpdate installation. AutoUpdate provides an easy way for users to download critical Windows updates. After the update is downloaded, the user can install the update on the system. If the user chooses to install the update, System Restore creates a restore point before the installation of the update begins.
  • System restore. For example, if a user accidentally chooses the wrong restore point, the user can undo the restore operation by choosing a restore point before the system restore took place. The user can then choose the correct restore point.

Scheduled restore points

System Restore provides users with the ability to restore the system to its state on a specific days. It does this by creating a restore point every 24 hours and every 10 hours of system session time. These restore points are saved and compressed, and these choices are available to the user through the System Restore user interface. Users can also manually create and name a restore point at any time from within the System Restore user interface.


System Restore API

The System Restore API enables an application to manage restore points. There is also a scriptable interface available through Windows Management Instrumentation (WMI).

For more information about the System Restore API, see the following topics:

  • Calling SRSetRestorePoint
  • Restore Point Description Text
  • Nested Calls to SRSetRestorePoint

For more information about the System Restore WMI Classes, see Configuring System Restore.


Calling SRSetRestorePoint

An application can create an install point before it causes a significant system change, such as an install, uninstall, or feature update.

To create a restore point just prior to installation, call the SRSetRestorePoint function with the dwEventType member of the RESTOREPOINTINFO structure set to BEGIN_SYSTEM_CHANGE. To notify System Restore that the installation has been completed, call SRSetRestorePoint with dwEventType set to END_SYSTEM_CHANGE.

If the user decides to cancel the application installation, the application should remove the restore point. To remove a restore point, call the SRRemoveRestorePoint function, or call SRSetRestorePoint with dwRestorePointType set to CANCELLED_OPERATION and dwEventType set to END_SYSTEM_CHANGE.

For an example, see Using System Restore.


Restore Point Description Text

When an application calls the SRSetRestorePoint function, it can provide any text as a description for the restore point; however, the following table shows the recommended description text.

System modification | Restore point type | Description
Application installation | APPLICATION_INSTALL | Installed AppName
Application modification (add/remove features) | MODIFY_SETTINGS | Configured AppName
Application removal | APPLICATION_UNINSTALL | Removed AppName
Device driver installation | DEVICE_DRIVER_INSTALL | Installed DriverName

Installers, such as Windows Installer and InstallShield, use these conventions for the description text:

  • The product name follows the verb; for example, Installed AppName.
  • The product name can be used alone (AppName) or the product name and the company name may both be used (MyCompany AppName).


Nested Calls to SRSetRestorePoint

This topic describes the difference in support for nested calls to SRSetRestorePoint in Windows Me and Whistler.

Windows Me

Restoring the system using restore points created by nested calls to SRSetRestorePoint can make the system unstable. Always create a restore point by calling SRSetRestorePoint to mark the beginning of a set of changes to the system, and use the next call to SRSetRestorePoint to mark the end of that set of changes.

Be very careful not to make nested calls to the SRSetRestorePoint function, such as the following:

Call SRSetRestorePoint for restore point A with dwEventType = BEGIN_SYSTEM_CHANGE
Call SRSetRestorePoint for restore point B with dwEventType = BEGIN_SYSTEM_CHANGE
Call SRSetRestorePoint for restore point B with dwEventType = END_SYSTEM_CHANGE
Call SRSetRestorePoint for restore point A with dwEventType = END_SYSTEM_CHANGE

This can happen when installing two applications, A and B. The installer calls SRSetRestorePoint with a start point for A. In the process of installing A, the installer launches the install program for B, then calls SRSetRestorePoint with a start point for B. After B is installed, the installer resumes the installation of A, then calls SRSetRestorePoint with an end point.

Looking at the System Restore UI, the user finds restore points for both applications created on the day the installations took place. The user can elect to use the restore point for the second application. In the resulting restored system state, the changes made by the second application have been removed. However, only those changes made by the first application prior to the installation of the second application have been removed, and this partial restoration can make the system unstable.

Whistler

Whistler provides additional support through the BEGIN_NESTED_SYSTEM_CHANGE and END_NESTED_SYSTEM_CHANGE event types. Applications can safely call SRSetRestorePoint when using these types. The first call to the function creates a restore point. Subsequent nested calls to the function fail with ERROR_ALREADY_EXISTS. For example, suppose an application makes the following calls:

Call SRSetRestorePoint for restore point A with dwEventType = BEGIN_NESTED_SYSTEM_CHANGE
Call SRSetRestorePoint for restore point B with dwEventType = BEGIN_NESTED_SYSTEM_CHANGE
Call SRSetRestorePoint for restore point B with dwEventType = END_NESTED_SYSTEM_CHANGE
Call SRSetRestorePoint for restore point A with dwEventType = END_NESTED_SYSTEM_CHANGE

The second call returns ERROR_ALREADY_EXISTS; it does not create a new restore point because the call is nested.


Configuring System Restore

[This is preliminary documentation and subject to change.]

System Restore uses Windows Management Instrumentation (WMI) to provide a scriptable way of configuring and using its functionality. It exposes two classes, SystemRestore and SystemRestoreConfig, in the root\default namespace.

The SystemRestore class provides methods for the following tasks:

  • disabling and enabling monitoring
  • listing available restore points
  • initiating a restore on the local system
  • retrieve the status of the last system restore

The SystemRestoreConfig class provides properties for controlling the frequency of scheduled restore point creation and the amount of disk space consumed by System Restore on each drive.

Both classes can be accessed remotely using standard WMI techniques. For a complete description of WMI, see Windows Management Instrumentation.


Using System Restore

The following examples demonstrate how to create and cancel restore points using the SRSetRestorePoint function.

Example 1: Create a restore point.

#include <stdio.h>
#include <windows.h>
#include "srrestoreptapi.h"

int main(void)
{
   RESTOREPOINTINFO RestPtInfo;
   STATEMGRSTATUS SMgrStatus;

   // Initialize the RESTOREPOINTINFO structure
   RestPtInfo.dwEventType = BEGIN_SYSTEM_CHANGE;

   // Notify the system that changes are about to be made.
   // An application is to be installed.
   RestPtInfo.dwRestorePtType = APPLICATION_INSTALL;

   // Set RestPtInfo.llSequenceNumber.
   RestPtInfo.llSequenceNumber = 0;

   // String to be displayed by System Restore for this restore point.
   strcpy(RestPtInfo.szDescription, "First Restore Point");

   // Notify the system that changes are to be made and that
   // the beginning of the restore point should be marked.
   if(!SRSetRestorePoint(&RestorePtInfo, &SMgrStatus))
   {
      printf("Couldn't set the beginning of the restore point.\n");
      return 0;
   }

   // The application performs some installation operations here.

   // Re-initialize the RESTOREPOINTINFO structure to notify the
   // system that the operation is finished.
   RestPtInfo.dwEventType = END_SYSTEM_CHANGE;

   // End the system change by returning the sequence number
   // received from the first call to SRSetRestorePoint.
   RestPtInfo.llSequenceNumber = SMgrStatus.llSequenceNumber;

   // Notify the system that the operation is done and that this
   // is the end of the restore point.
   if(!SRSetRestorePoint(&RestorePtInfo, &SMgrStatus))
   {
      printf("Couldn't set the end of the restore point.\n");
   }

   return 0;
}

Example 2: Create and cancel a restore point.

#include <stdio.h>
#include <windows.h>
#include "srrestoreptapi.h"

int __cdecl main(int argc, char* argv[])
{
   RESTOREPOINTINFO RestorePtSpec;
   STATEMGRSTATUS SMgrStatus;

   // Initialize the RESTOREPOINTINFO structure.
   RestorePtSpec.dwEventType=BEGIN_SYSTEM_CHANGE;
   RestorePtSpec.dwRestorePtType=APPLICATION_INSTALL;
   RestorePtSpec.llSequenceNumber=0;
   strcpy(RestorePtSpec.szDescription,"SAMPLE RESTORE POINT");

   if (SRSetRestorePoint(&RestorePtSpec, &SMgrStatus))
   {
      printf("Restore point set. Restore point data:\n");
      printf("Sequence Number=%lld\n",SMgrStatus.llSequenceNumber);
      printf("Status=%u\n",SMgrStatus.nStatus);

      // Restore Point Spec to cancel the previous restore point.
      RestorePtSpec.dwEventType=END_SYSTEM_CHANGE;
      RestorePtSpec.dwRestorePtType=CANCELLED_OPERATION;
      RestorePtSpec.llSequenceNumber=SMgrStatus.llSequenceNumber;

      // This is the sequence number returned by the previous call.

      // Canceling the previous restore point
      if (SRSetRestorePoint(&RestorePtSpec, &SMgrStatus))
      {
         printf("Restore point canceled. Restore point data:\n");
         printf("Sequence Number=%lld\n",SMgrStatus.llSequenceNumber);
         printf("Status=%u\n",SMgrStatus.nStatus);
      }
      else printf("Couldn't cancel restore point.\n");
   }
   else printf("Couldn't set restore point.\n");

   return 0;
}


System Restore Reference

The following elements are used with System Restore:

  • System Restore Functions
  • System Restore Structures
  • System Restore WMI Classes
  • Monitored File Extensions


System Restore Functions

The following functions are used with System Restore.

Function | Description
SRRemoveRestorePoint | Deletes the specified restore point.
SRSetRestorePoint | Specifies the beginning and the ending of a set of changes so that System Restore can create a restore point.


SRRemoveRestorePoint

[This is preliminary documentation and subject to change.]

The SRRemoveRestorePoint function deletes the specified restore point.

DWORD SRRemoveRestorePoint(
  DWORD dwRPNum
);

Parameters

dwRPNum
[in] Specifies the sequence number of the restore point.

Return Value

If the function succeeds, the return value is ERROR_SUCCESS.

If the specified restore point does not exist or cannot be removed, the return value is ERROR_INVALID_DATA. All other error codes indicate an internal error.

Requirements

Windows NT/2000 or later: Requires Whistler.
Windows 95/98/Me: Unsupported.
Header: Declared in SRRestorePtAPI.h.
Library: Use SrClient.lib.

See Also

SRSetRestorePoint


SRSetRestorePoint

The SRSetRestorePoint function specifies the beginning and the ending of a set of changes so that System Restore can create a restore point.

For a scriptable equivalent, see CreateRestorePoint.

BOOL SRSetRestorePoint(
  PRESTOREPOINTINFO pRestorePtSpec,
  PSTATEMGRSTATUS pSMgrStatus
);

Parameters

pRestorePtSpec
[in] Pointer to a RESTOREPOINTINFO structure that specifies the restore point.
pSMgrStatus
[out] Pointer to a STATEMGRSTATUS structure that receives the status information.

Return Value

If the function succeeds, the return value is TRUE. The llSequenceNumber member of pSMgrStatus receives the sequence number of the restore point.

If the function fails, the return value is FALSE. The nStatus member of pSMgrStatus receives error information.

Whistler: If you make a nested call to SRSetRestorePoint, the error is ERROR_ALREADY_EXISTS.

Remarks

This function cannot be called in safe mode. It also fails if System Restore has been disabled (see Disable).

When you call this function, System Restore takes a full snapshot of the registry and other system databases.

To create restore points just prior to a system change, call SRSetRestorePoint with the dwEventType member of the RESTOREPOINTINFO structure set to BEGIN_SYSTEM_CHANGE. After the changes to the system have been completed, call SRSetRestorePoint with dwEventType set to END_SYSTEM_CHANGE.

If the user decides to cancel an application installation after it has already started, you must remove the restore point created by SRSetRestorePoint. To cancel the creation of a restore point, call SRRemoveRestorePoint (or call SRSetRestorePoint with dwRestorePointType set to CANCELLED_OPERATION, dwEventType set to END_SYSTEM_CHANGE, and llSequenceNumber set to the sequence number of the restore point).

Windows Me: By design, SRSetRestorePoint fails if there are pending file rename operations. Therefore, to avoid a failure, only call SRSetRestorePoint after the computer has been rebooted. Pending file operations are stored in the Wininit.ini file.

Be careful not to make nested calls to SRSetRestorePoint. For more information, see Nested calls to SRSetRestorePoint.

Requirements

Windows NT/2000 or later: Requires Whistler.
Windows 95/98/Me: Requires Windows Me.
Header: Declared in SRRestorePtAPI.h.
Library: Use SrClient.lib.

See Also

SRRemoveRestorePoint


System Restore Structures

The following structures are used with System Restore:

RESTOREPOINTINFO
STATEMGRSTATUS


RESTOREPOINTINFO

The RESTOREPOINTINFO structure contains information used by the SRSetRestorePoint function.

typedef struct _RESTOREPTINFO {
    DWORD dwEventType;
    DWORD dwRestorePtType;
    INT64 llSequenceNumber;
    TCHAR szDescription[MAX_DESC];
} RESTOREPOINTINFO, *PRESTOREPOINTINFO;

Members

dwEventType
Specifies the event type. This member can be one of the following values.
Event type | Description
BEGIN_NESTED_SYSTEM_CHANGE Whistler: A system change has begun. A subsequent nested call does not create a new restore point.

Subsequent calls must use END_NESTED_SYSTEM_CHANGE, not END_SYSTEM_CHANGE.
BEGIN_SYSTEM_CHANGE | A system change has begun.
END_NESTED_SYSTEM_CHANGE | Whistler: A system change has ended.
END_SYSTEM_CHANGE | A system change has ended.

dwRestorePtType
Specifies the type of restore point. This member can be one of the following values.
Restore point type | Description
APPLICATION_INSTALL | An application has been installed.
APPLICATION_UNINSTALL | An application has been uninstalled.
DEVICE_DRIVER_INSTALL | A device driver has been installed.
MODIFY_SETTINGS | An application has had features added or removed.
CANCELLED_OPERATION | An application needs to delete the restore point it created. For example, an application would use this flag when a user cancels an installation.

llSequenceNumber
Specifies the sequence number of the restore point. To end a system change, set this to the sequence number returned by the first call to SRSetRestorePoint.
szDescription
Specifies the description that is displayed so the user can easily identify a restore point. The maximum length of an ANSI string is MAX_DESC. The maximum length of a Unicode string is MAX_DESC_W. For more information, see Restore Point Description Text.

Requirements

Windows NT/2000 or later: Requires Whistler.
Windows 95/98/Me: Requires Windows Me.
Header: Declared in SRRestorePtAPI.h.

See Also

SRSetRestorePoint


STATEMGRSTATUS

The STATEMGRSTATUS structure contains status information used by the SRSetRestorePoint function.

typedef struct _SMGRSTATUS {
    UINT nStatus;
    INT64 llSequenceNumber;
} STATEMGRSTATUS, *PSTATEMGRSTATUS;

Members

nStatus
Specifies the status code. For a list of values, see the Remarks section.
llSequenceNumber
Specifies the sequence number of the restore point.

Remarks

The following table lists the status codes returned in the nStatus member. Note that all the status codes indicate failure except ERROR_SUCCESS.

Status Code | Meaning
ERROR_SUCCESS | The call succeeded.
ERROR_BAD_ENVIRONMENT | The function was called in safe mode.
ERROR_ALREADY_EXISTS | Whistler: The restore point has already been created by a previous call.
ERROR_DISK_FULL | Whistler: System Restore is in standby mode because disk space is low.
ERROR_FILE_EXISTS | Windows Me: Pending file-rename operations exist in the file %windir%\Wininit.ini.
ERROR_INTERNAL_ERROR | An internal error occurred.
ERROR_INVALID_DATA | The sequence number is invalid.
ERROR_SERVICE_DISABLED | System Restore is disabled.
ERROR_TIMEOUT | The call timed out due to a wait on a mutex for setting restore points.

Requirements

Windows NT/2000 or later: Requires Whistler.
Windows 95/98/Me: Requires Windows Me.
Header: Declared in SRRestorePtAPI.h.

See Also

SRSetRestorePoint


System Restore WMI Classes

[This is preliminary documentation and subject to change.]

The following WMI classes are used with System Restore.

WMI class | Description
SystemRestore | Provides methods for disabling and enabling monitoring, listing available restore points, and initiating a restore on the local system.
SystemRestoreConfig | Provides properties for controlling the frequency of scheduled restore point creation and the amount of disk space consumed on each drive.


SystemRestore

[This is preliminary documentation and subject to change.]

The SystemRestore WMI class provides methods for disabling and enabling monitoring, listing available restore points, and initiating a restore on the local system.

class SystemRestore
{
    [read, write]
    String Description;

    [read, write]
    uint32 RestorePointType;

    [read, write]
    uint32 EventType;

    [read, write, key]
    uint32 SequenceNumber;

    [read, write]
    String CreationTime;

    [Implemented, static]
    uint32 CreateRestorePoint([In] String Description, [In] uint32 RestorePointType, [In] uint32 EventType );

    [Implemented, static]
    uint32 Enable([In] String Drive);

    [Implemented, static]
    uint32 Disable([In] String Drive);

    [Implemented, static]
    uint32 Restore([In] uint32 SequenceNumber);

    [Implemented, static]
    uint32 GetLastRestoreStatus();

};

Properties

Description
Specifies the description that is displayed so the user can easily identify a restore point. The maximum length of an ANSI string is MAX_DESC. The maximum length of a Unicode string is MAX_DESC_W. For more information, see Restore Point Description Text.
RestorePointType
Specifies the type of restore point. This member can be one of the following values.
Restore point type | Description
APPLICATION_INSTALL | An application has been installed.
APPLICATION_UNINSTALL | An application has been uninstalled.
DEVICE_DRIVER_INSTALL | A device driver has been installed.
MODIFY_SETTINGS | An application has had features added or removed.
CANCELLED_OPERATION | An application needs to delete the restore point it created. For example, an application would use this flag when a user cancels an installation.

EventType
Specifies the event type. This member can be one of the following values.
Event type | Description
BEGIN_NESTED_SYSTEM_CHANGE Whistler: A system change has begun. A subsequent nested call does not create a new restore point.

Subsequent calls must use END_NESTED_SYSTEM_CHANGE, not END_SYSTEM_CHANGE.
BEGIN_SYSTEM_CHANGE | A system change has begun.
END_NESTED_SYSTEM_CHANGE | Whistler: A system change has ended.
END_SYSTEM_CHANGE | A system change has ended.

SequenceNumber
Specifies the sequence number of the restore point.
CreationTime
Specifies the time at which the state change occurred.

Methods

The SystemRestore class provides the following methods.

Method | Description
CreateRestorePoint | Creates a restore point.
Disable | Disables monitoring on a particular drive.
Enable | Enables monitoring on a particular drive.
GetLastRestoreStatus | Retrieves the status of the last system restore.
Restore | Initiates a system restore.

Remarks

You can obtain a list of restore points by using the SWbemServices.InstancesOf method to retrieve a collection of SystemRestore objects. You can use the class properties to identify the restore point.

The following sample script enumerates the current restore points.

Set RPSet = GetObject("winmgmts:root/default").InstancesOf ("SystemRestore")
for each RP in RPSet
    wscript.Echo "Dir: RP" & RP.SequenceNumber & ", Name: " & RP.Description & ", Type: ", RP.RestorePointType & ", Time: " & RP.CreationTime
next

Requirements

Windows NT/2000 or later: Requires Whistler.
Windows 95/98/Me: Unsupported.

See Also

Windows Management Instrumentation


CreateRestorePoint Method of the SystemRestore Class

[This is preliminary documentation and subject to change.]

The CreateRestorePoint method creates a restore point.

This method is the scriptable equivalent of the SRSetRestorePoint function.

uint32 CreateRestorePoint(
  String Description,
  uint32 RestorePointType,
  uint32 EventType
);

Parameters

Description
[in] Specifies the description that is displayed so the user can easily identify a restore point. The maximum length of an ANSI string is MAX_DESC. The maximum length of a Unicode string is MAX_DESC_W. For more information, see Restore Point Description Text.
RestorePointType
[in] Specifies the type of restore point. This member can be one of the following values.
Restore point type | Description
APPLICATION_INSTALL | An application has been installed.
APPLICATION_UNINSTALL | An application has been uninstalled.
DEVICE_DRIVER_INSTALL | A device driver has been installed.
MODIFY_SETTINGS | An application has had features added or removed.
CANCELLED_OPERATION | An application needs to delete the restore point it created. For example, an application would use this flag when a user cancels an installation.

EventType
[in] Specifies the event type. This member can be one of the following values.
Event type | Description
BEGIN_NESTED_SYSTEM_CHANGE Whistler: A system change has begun. A subsequent nested call does not create a new restore point.

Subsequent calls must use END_NESTED_SYSTEM_CHANGE, not END_SYSTEM_CHANGE.
BEGIN_SYSTEM_CHANGE A system change has begun.

A subsequent call must use END_SYSTEM_CHANGE, not END_NESTED_SYSTEM_CHANGE.
END_NESTED_SYSTEM_CHANGE | Whistler: A system change has ended.
END_SYSTEM_CHANGE | A system change has ended.

Return Values

If the method succeeds, the return value is S_OK. Otherwise, the method returns one of the COM error codes defined in WinError.h.

Example

Set Args = wscript.Arguments
If Args.Count() > 0 Then
    RpName = Args.item(0)
Else
    RpName = "Vbscript"
End If

Set obj = GetObject("winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore")

If (obj.CreateRestorePoint(RpName, 0, 100)) = 0 Then
    wscript.Echo "Success"
Else
    wscript.Echo "Failed"
End If

See Also

SystemRestore


Disable Method of the SystemRestore Class

[This is preliminary documentation and subject to change.]

The Disable method disables monitoring on a particular drive.

uint32 Disable(
  String Drive
);

Parameters

Drive
[in] Specifies the drive to be disabled. The drive string should be of the form "C:\". If this parameter is the system drive or an empty string (""), no drives are monitored.

Return Values

If the method succeeds, the return value is S_OK. Otherwise, the method returns one of the COM error codes defined in WinError.h.

Example

Set Args = wscript.Arguments
If Args.Count() > 0 Then
    Drive = Args.item(0)
Else
    Drive = ""
End If

Set obj = GetObject("winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore")

If (obj.Disable(Drive)) = 0 Then
    wscript.Echo "Success"
Else
    wscript.Echo "Failed"
End If

See Also

SystemRestore


Enable Method of the SystemRestore Class

[This is preliminary documentation and subject to change.]

The Enable method enables monitoring on a particular drive.

uint32 Enable(
  String Drive
);

Parameters

Drive
[in] Specifies the drive to be enabled. The drive string should be of the form "C:\". If this parameter is the system drive or an empty string (""), all drives are monitored.

Return Values

If the method succeeds, the return value is S_OK. Otherwise, the method returns one of the COM error codes defined in WinError.h.

Remarks

The Enable method does not wait for monitoring to be enabled completely before it returns, because this could take a while. Instead, it returns immediately after starting the System Restore service and filter driver.

To enable System Restore on a non-system drive, you must first enable System Restore on the system drive.

This method fails in safe mode.

Example

Set Args = wscript.Arguments
If Args.Count() > 0 Then
    Drive = Args.item(0)
Else
    Drive = ""
End If

Set obj = GetObject("winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore")
If (obj.Enable(Drive)) = 0 Then
    wscript.Echo "Success"
Else
    wscript.Echo "Failed"
End If

See Also

SystemRestore


GetLastRestoreStatus Method of the SystemRestore Class

[This is preliminary documentation and subject to change.]

The GetLastRestoreStatus method retrieves the status of the last system restore.

uint32 GetLastRestoreStatus(void);

Parameters

This method has no parameters.

Return Values

The method returns one of the following status values.

Value | Meaning
0 | The last restore failed.
1 | The last restore was successful.
2 | The last restore was interrupted.

Example

Set obj = GetObject("winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore")
stat = obj.GetLastRestoreStatus()
If stat = 0 Then
    wscript.Echo "Failed"
ElseIf stat = 1 Then
    wscript.Echo "Success"
ElseIf stat = 2 Then
    wscript.Echo "Interrrupted"
End If

See Also

SystemRestore


Restore Method of the SystemRestore Class

[This is preliminary documentation and subject to change.]

The Restore method initiates a system restore. The caller must force a system reboot. The actual restoration occurs during the reboot.

uint32 Restore(
  uint32 SequenceNumber
);

Parameters

SequenceNumber
[in] Specifies the sequence number of the restore point. To determine the sequence number for a specific restore point, enumerate all restore points on the system.

Return Values

If the method succeeds, the return value is S_OK. Otherwise, the method returns one of the COM error codes defined in WinError.h.

Example

Set Args = wscript.Arguments
RpNum = Args.item(0)
Set obj = GetObject("winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestore")
if obj.Restore(RpNum) <> 0 Then
    wscript.Echo "Restore failed"
End If
Set OpSysSet = GetObject("winmgmts:{(Shutdown)}//./root/cimv2").ExecQuery("select * from Win32_OperatingSystem where Primary=true")
for each OpSys in OpSysSet
    OpSys.Reboot()
next

See Also

SystemRestore


SystemRestoreConfig

[This is preliminary documentation and subject to change.]

The SystemRestoreConfig WMI class provides properties for controlling the frequency of scheduled restore point creation and the amount of disk space consumed on each drive.

class SystemRestoreConfig {
    uint32 RPSessionInterval;
    uint32 RPGlobalInterval;
    uint32 RPLifeInterval;
    uint32 DiskPercent;
};

Properties

RPSessionInterval
Specifies the time interval, in seconds, at which scheduled system checkpoints are created during the session. The default value is 36,000 (10 hours).
RPGlobalInterval
Specifies the absolute time interval, in seconds, at which scheduled system checkpoints are created. The default value is 86,400 (24 hours).
RPLifeInterval
Specifies the time interval, in seconds, for which restore points are preserved. When a restore point becomes older than this specified interval, it is deleted. The default value is 2,592,000 (30 days).
DiskPercent
Specifies the maximum amount of disk space on each drive that can be used by System Restore. This value is specified as a percentage of the total drive space. The default value is 12 percent.

Example

Set Args = wscript.Arguments
Set regSR = GetObject("winmgmts:{impersonationLevel=impersonate}!root/default:SystemRestoreConfig='SR'")

If Args.Count() = 0 Then
    Wscript.Echo "Usage: RegSR [RP{Session|Global|Life}Interval[=value]] [DiskPercent[=value]]"
Else
For i = 0 To Args.Count() - 1
    Myarg = Args.Item(i)
    Pos = InStr(Myarg, "=")
    If Pos <> 0 Then
        Myarray = Split(Myarg, "=", -1, 1)
        myoption = Myarray(0)
        value = Myarray(1)
    Else
        myoption = Myarg
    End If
    If myoption = "RPSessionInterval" Then
        If Pos = 0 Then
            Wscript.Echo "RPSessionInterval = " & regSR.RPSessionInterval
        Else
            regSR.RPSessionInterval = value
            regSR.Put_
        End If
    ElseIf myoption = "RPGlobalInterval" Then
        If Pos = 0 Then
            Wscript.Echo "RPGlobalInterval = " & regSR.RPGlobalInterval
        Else
            regSR.RPGlobalInterval = value
            regSR.Put_
        End If
    ElseIf myoption = "RPLifeInterval" Then
        If Pos = 0 Then
            Wscript.Echo "RPLifeInterval = " & regSR.RPLifeInterval
        Else
            regSR.RPLifeInterval = value
            regSR.Put_
        End If
    ElseIf myoption = "DiskPercent" Then
        If Pos = 0 Then
            Wscript.Echo "DiskPercent = " & regSR.DiskPercent
        Else
            regSR.DiskPercent = value
            regSR.Put_
        End If
    End If
Next
End If

Requirements

Windows NT/2000 or later: Requires Whistler.
Windows 95/98/Me: Unsupported.

See Also

Restore Points, Windows Management Instrumentation


Monitored File Extensions

The following is a list of monitored file extensions. Files with these extensions are monitored by System Restore.

~~C
~~D
12A
1PA
1ST
386
8BA
8BY
8LI
A2A
AAX
ABM
ABR
ACF
ACG
ACO
ACS
ADK
ADW
ADX
AFM
AID
AIP
ALT
AM
AMB
APL
APM
APP
APV
AR
ARX
AS
AT
ATC
ATL
ATM
ATN
AW
AWE
AWX
AX
B0
BAT
BCF
BD
BDR
BE
BGB
BGR
BID
BIT
BK1
BLD
BM
BMA
BND
BNF
BOF
BPP
BPT
BPX
BT
BTN
BUC
CAG
CAO
CAT
CBS
CC
CF
CFG
CHA
CHI
CIK
CL
CLW
CLX
CLY
CMD
CNT
CNV
COL
COM
CPB
CPL
CQM
CR
CRL
CRS
CRV
CS
CSB
CSI
CSL
CSW
CTB
CTG
CTY
CUS
CW_
D01
D02
D03
D04
D05
D32
DATA
DB0
DB1
DB2
DBA
DBD
DBL
DC2
DCA 		DCF
DCI
DCL
DDB
DDD
DEP
DES
DESKLINK
DET
DGM
DIALOG
DID
DIR
DISABLED
DIX
DLL
DOB
DOS
DRC
DRS
DRV
DS
DSC
DSK
DSN
DSR
DSX
DT
DTT
DUN
DVB
DWT
DXT
DYNCMD
ECF
EFF
EFM
EID
EL
ELM
END
ENU
ENV
EOT
EPF
ET
EX_
EXA
EXCLUDE
EXE
EXL
F32
FAE
FAM
FAS
FFP
FIN
FIO
FLL
FLW
FMC
FMP
FNT
FON
FSG
FSS
GCS
GDB
GI_
GMS
GNG
GPD
GS
GSF
GST
GUIATN
GUICMD
GVT
GWD
H16
HCT
HDC
HDI
HDP
HFX
HGD
HHC
HHK
HK0
HK1
HK2
HK3
HLP
HM
HTA
HTC
HTZ
HU
HWL
HYP
IAT
IBD
ICD
ICM
ICR
ICW
ID
IDS
IFA
ILF
ILG
ILM
IN_
INCL
INF
INI 		INK
INL
INO
INS
INV
IP
IRS
ISA
ISS
ISU
ITF
J0
JA
JBR
JCM
JGD
K01
K02
K03
KBD
KNN
KO
L0
L2L
L2P
LAB
LAM
LAST
LCA
LCK
LDA
LEX
LGC
LGD
LGE
LGF
LIC
LID
LIM
LIVEREG
LLI
LMC
LMG
LMP
LNK
LO~
LRD
LRS
LSM
LSO
LSQ
LSS
LSX
LT
LTS
LV
M20
MAPIMAIL
MC
MCD
MCM
MD2
MDM
MDP
ME
MFL
MHK
MIL
MLN
MMC
MMM
MMX
MNC
MNL
MNR
MNS
MOF
MOR
MP
MPD
MPT
MSB
MSC
MSE
MSI
MST
MSK
MSO
MXT
MYDOCS
N0
NAM
NAME
NDX
NEW
NFO
NIB
NMD
NOD
NPM
NQM
NQV
NSI
NSW
NTE
NU4
NUM
NUS
NV
OBE
OCM
OCX
ODE
ODL
OLB
OLD 		OLE
OP
OPG
OR5
OSD
OUT
P2A
PAG
PBC
PBV
PC3
PCI
PDF
PDI
PDR
PEN
PER
PFB
PFM
PFR
PH
PHO
PHX
PID
PIF
PL3
PLY
PMT
PNF
POC
POF
POL
PPD
PR4
PROPERTIES
PRX
PSC
PSF
PSP
PT
PTH
PTX
PV
Q0
Q32
Q3X
QDAT
QJF
QRS
QTC
QTD
QTW
QUE
QUF
QUT
R0
R98
RAD
RAT
RC2
RCP
RCT
RDB
RDC
REF
REG
RGS
RH
RI
RJS
RO
ROB
RPR
RPS
RSD
RSP
RSRC
RTA
RTR
RU
S98
SAM
SAX
SCK
SCR
SCS
SDI
SECURITY
SELFREG
SFP
SG
SG0
SG1
SHARED
SHR
SHX
SIF
SK
SLL
SMC
SMM
SNP
SOF
SPC
SPE
SPM
SPT
SPX
SR
SRC
SRG
SRT
SSM
SST
ST4
STB 		STD
STF
STP
SWB
SYM
SYN
SYS
T32
TAG
TB
TBL
TDF
TH
THE
THK
THS
TID
TIE
TIP
TLB
TLD
TLF
TLT
TLU
TLX
TMC
TNL
TOL
TPA
TR
TRE
TRG
TRO
TSK
TSP
TTF
TTS
TUB
TUM
TUW
TV
TVC
TWD
TXR
TYM
TZD
UBM
UCM
UCP
UCT
UDC
UDI
UDL
UDT
UID
UIL
UK
ULG
ULK
UNT
US
USA
USERPROFILE
USP
USR
UTX
V10
VBS
VBX
VBZ
VCPREF
VDB
VER
VFM
VFX
VIL
VLX
VM
VOF
VPH
VPX
VQA
VQM
VSC
VSH
VWP
VXD
W32
W98
WA_
WBD
WBM
WCD
WDL
WDS
WINSYS
WIPEINFO
WIPESLACK
WMZ
WPC
WPX
WRF
WSL
WTB
WTR
XLL
XMX
XRS
XTU
ZFSENDTOTARGET
ZH
ZH_TW
ZRW


Topic Not Found

No matching topic was found. Some possible reasons and remedies are as follows:

  • The file (.chm) that contains the destination topic is not in the expected location.

    Remedy: Rerun the MSDN Library Setup.

  • The file (.chm) that contains the current topic or destination topic is out-of-date and the link is no longer valid.

    Remedy: Install the latest version of the MSDN Library.

  • The MSDN Library CD is not in the CD-ROM drive.

    Remedy: Insert the MSDN Library CD into the CD-ROM drive.