5 hours ago
4
Follow ZDNET: Add us as a preferred source on Google.
ZDNET's key takeaways
- The Point-in-time Restore feature is now available for all Windows editions.
- It takes daily snapshots of the system state to help recover from a serious problem.
- If your system drive is 200 GB or larger, the feature is on by default.
Do you remember July 19, 2024? The great CrowdStrike-Windows meltdown?
Say that date to a network admin in any big company and watch them shudder at the memory.
Starting at 12:09 AM, Eastern Daylight Time, 8.5 million Windows PCs, including machines owned by half the Fortune 500 and the top US cybersecurity agency, began spiraling into Blue Screen of Death reboot loops. The only recovery option was for an admin to personally visit each machine, reboot it into the Windows Recovery Environment, and remove the defective CrowdStrike file that was causing the crashes. Restart the PC and move on to the next one.
Also: Why this fully agentic ransomware attack is giving researchers nightmares
At the time, Microsoft promised changes that would make Windows more resilient. The first of those fixes, Quick Machine Recovery, arrived in Windows almost exactly a year after the CrowdStrike debacle. Now, as we approach the second anniversary, a new recovery feature is available on all editions of Windows. The Point-in-time Restore feature is the latest release from the Windows Resiliency Initiative. And it's a big deal.
What is it?
This tool solves a problem as old as the PC itself. "I don't understand. It was working fine yesterday. Then I did [some seemingly innocuous thing] and now it's crashing." About that time, you desperately wish your keyboard had an Undo Today button.
That's Point-in-time Restore. It's one of those rare Microsoft features whose name perfectly describes its function. It rolls back your PC to a time when it was working properly, undoing everything that happened between then and now. Aside from ensuring that the feature is turned on, there's nothing else you have to do.
Also: Your Windows 11 PC might be hiding a 500GB storage bug - how to check
Point-in-Time Restore has been in preview and was finally released to public builds of Windows at the end of June. It uses the Volume Shadow Copy Service to create a snapshot of your PC -- the operating system, apps, settings, files ... everything. It takes one snapshot a day, around the same time each day, and saves the three most recent snapshots.
By default, the Point-in-time Restore feature takes one snapshot a day and keeps restore points for 72 hours.
Shadow copies are extremely efficient, so the feature uses relatively little disk space. By default, it's configured to use 2% of the system drive, and because it shares disk space with the system reserved storage feature, you might not even notice a change. On one test PC with a 128 GB system drive and 8 GB of RAM, two restore points took up 2.2 GB of space. On a much more heavily used PC with a 700 GB system drive, three restore points used about 9 GB of disk space.
To apply one of those restore points, boot to the Windows Recovery Environment (this happens automatically after three failed starts in a row) and choose the Troubleshoot option. You see a screen like this:
When a PC fails to start three times in a row, it starts the Windows Recovery Environment. Click Troubleshooting to get to this menu.
Choose the Point-in-time Restore option at the top of the menu, go through multiple confirmations, enter a BitLocker recovery key if the system drive is encrypted, and then wait while the previous snapshot is restored. On my test PCs, it took between 30 and 45 minutes, but your restore time could vary, depending on your hardware.
How is it different from System Restore?
System Restore is an absolutely ancient feature. It debuted in Windows Me, back in 2000, and survives in the legacy Control Panel in Windows 11, where it's often disabled by default. When it's on, it takes snapshots as part of every driver installation and Windows update. You can also create manual restore points.
Also: You can soon restore Windows 11 from scratch even if it can't boot up - here's how
System Restore snapshots are less comprehensive than Point-in-time Restore points. The biggest difference is that Point-in-time Restore affects the entire system, data files, and all. Whatever files you saved locally after the restore point was created are gone, whereas System Restore doesn't touch document files at all.
One of the key assumptions is that anyone using this feature is already storing important files in the cloud. Those files are not affected by the Point-in-time Restore snapshot.
Point-in-time Restore is much easier to use and is pretty much guaranteed to be on and stay on with no attention required on your part. But there's no reason not to use both.
Microsoft has a detailed comparison table that shows the differences between the two features.
How to turn on Point-in-time Restore
If your PC has a system drive that's at least 200 GB in size, and you're running a retail or OEM edition of Windows Home or Pro, Point-in-time Restore is enabled by default. If your drive is smaller than 200 GB, you can turn on the feature manually. Go to Settings > System > Recovery. Click the "View or edit" button next to "Point-in-time Restore," and turn on the switch.
The Quick Machine Recovery and Point-in-time Restore features are both part of the Windows Resiliency Initiative.
On Windows 11 Enterprise edition, the feature is off by default and might require an administrator's approval to turn on.
How to configure it
As I mentioned earlier, Point-in-time Restore is set to use 2% of the system drive by default, and it shares this space with the reserved storage feature, so you might not notice any change in free space. It also intelligently manages disk usage and will discard snapshots if you need the space. You can change the maximum disk usage allowed from its page in Settings.
The two other settings - how often snapshots are taken and how many snapshots are kept - are probably grayed out and unavailable on your PC. That's not a bug; it's by design. At least for now, you can only configure those options on a PC running Windows 11 Enterprise edition.
Are there any gotchas?
The Point-in-time Restore feature is designed to be simple enough that even a technically unsophisticated user can accomplish it. If an administrator's help is required, a personal visit probably isn't necessary. But one potential headache is the possibility that the user will have to enter the 48-digit BitLocker recovery key when the system drive is encrypted.
Also: How to find your BitLocker recovery key - and save a secure backup copy before it's too late
The roadmap for this feature includes the ability to manage restore operation remotely using Microsoft Intune. But it's not there yet
The biggest gotcha involves the possibility of losing work when you apply a Point-in-time Restore snapshot. To be fair, you are warned very clearly. See for yourself:
As this warning makes clear, doing a Point-in-time Restore will erase any files you created or saved and undo any changes you made since the restore point was created.
But it still might be an unwelcome surprise for someone who was working on an important file that wasn't saved to the cloud. As far as I can tell, there's no easy way to undo the restore operation.
Still, if you've reached the point where you need to use this feature, losing a few hours of work is probably the least of your worries.
English (US) ·