System Restore Core

The System Restore Core component provides most of the System Restore feature, including the System Restore Service; the System Restore filter driver; the System Restore client API, WMI provider, and disk cleanup plug-in; and the System Restore restore module and Control Panel utility.

System Restore monitors system and application changes and is used to restore the system to a previous state in time.

The System Restore filter driver monitors file changes that are associated with system and application state. The System Restore service also copies some system stores that are not monitored by the System Restore filter driver, including the registry, WMI, COM+, and IIS stores.

The system state is saved as a restore point that is either created automatically by the System Restore service, by a client application, or manually by the user.

When a system or application is no longer performing as expected, System Restore service can be used to return the system or application to a state in which it was working correctly. The System Restore service is typically useful in scenarios where users install applications that modify core or redistributed system files, which can cause other applications or system features to fail.

The System Restore Core component works in combination with the System Restore User Interface component. The System Restore User Interface component provides the System Restore Wizard, the user interface for the System Restore service.


This component provides the System Restore service.

Associated Components

This component interacts with numerous components, including WMI Core, Windows Update Agent, Windows Installer Service, IIS Web Server, and COM+ Services.


The following table shows the configurable settings for this component.

SettingDefault Description
Checkpoint calendar frequency86,400 seconds (24 hours)Specifies the calendar frequency with which automatic system checkpoints or restore points are created. This values is calculated based on the elapsed time since the creation of the last restore point. This value is checked before the next value, checkpoint session frequency.

A value of 0 specifies that this option is inactive.

Checkpoint session frequency0Specifies the session length (duration of "uptime") after which an automatic system checkpoint or restore point is created. This value is calculated based on the elapsed time since the last restore point. The checkpoint calendar frequency value is checked before this value.

The default value of 0 indicates that this option is inactive.

Maximum data store (% of disk space)12%Specifies the maximum percentage of the hard disk to use to contain the System Restore datastore. An insufficient allocation could cause restore points to be purged before reaching the maximum age that is set by the restore point life value.
Restore point life7,776,000 seconds (90 days)Specifies the maximum age of a restore point before it is automatically purged from the datastore.


A restore point saves system databases such as the registry, the Component Object Model (COM+) database, the Windows Management Instrumentation (WMI) repository, and the IIS meta database. A file system filter driver monitors system file changes and makes backups. When the system is restored, all monitored file changes are undone, from the current point until the selected restore point, and the saved databases are replaced.

The list of monitored files and directories is specified either by extension or by name in %windir%\system32\restore\filelist.xml. Microsoft maintains this list.

System Restore does not restore deleted user documents.

System Restore automatically creates restore points every 24 hours while the system is idle. Additionally, users can create restore points by using the System Restore Wizard if the System Restore User Interface component is available. Also, installers such as Windows Installer and InstallShield create restore points before installing and uninstalling applications. Other client applications can call the SRSetRestorePoint function in the System Restore API to create restore points. The System Restore API is available in the Platform Software Development Kit (PSDK).

Restore point snapshots and file backup data are stored in the System Restore datastore on each system partition. System Restore automatically purges old restore points based on the size of its datastores and free disk space.

© 2006 Microsoft Corporation. All rights reserved.