How well is System Restore working in Win 7 – not theoretically, but really?

Topic

New Reply

Inquiry from DO: Can rolling back a System Restore point fix Windows Update problems? Before installing updates, Update says it is ‘creating Restore P
[See the full post at: How well is System Restore working in Win 7 – not theoretically, but really?]

Reply | Quote

Replies

The advice from MVPs is always that System Restore should only be used as a last resort so far as removing troublesome updates is concerned. It’s far better to uninstall the update completely using the Windows Updates’ “installed updates” screen. Using System Restore can result in a corrupted system as it may only partially uninstall the updates and leave a somewhat tangled mess!

Reply | Quote

I was afraid of that. (sigh)

Reply | Quote

On Tues afternoon, my main Win7 machine started downloading updates. How it got on Automatic I have no clue. Set on “Check but let me choose,” I had manually checked for updates earlier in the morning, never touching the “Change settings” button.

I immediately set it to “Never check” and rebooted – five updates that slipped in installed on that reboot. When it came back up, there was a yellow “!” in the shutdown button indicating updates pending. I rebooted again and two more updates slipped in.

Once it rebooted, I ran System Restore to the point created before the first five updates installed. After a reboot, all the seven updates were GONE.

Success

Reply | Quote

I haven’t used system restore in years on Win 7 64bit/ HP & Pro. Mainly due to being mounted on SSD’s and the excessive writes to the SSD.

Instead, I create a system image to an external SSD/HDD a few days prior to patch (roll-up) tuesday, then if anything goes down south, I restore the image using the imaging software within windows control panel itself from safe mode.

Due to the increase in ransomware, rootkits and viruses this also acts as a backup should any infections get through beyond patch (roll-up) tuesday.

1st rule in computing is..backup prior to changes including MS patches, better safe than sorry.

Reply | Quote

I wound back the other day because I deleted a programme and then decided that I wanted it. Did a system restore and it seems to have worked ok. Programme back.

Reply | Quote

If it was an update you wanted to remove I would do it by going to the installed updates screen and then ask it to uninstall.

Reply | Quote

My experience is that System Restore is extremely dependable until you need it.

Reply | Quote

In that situation I just restore a disk image (I take one weekly).

I tried the System Restore some time back but wasn’t impressed with the result so have never quite trusted it.

Reply | Quote

I had a problem with MSE awhile back, and when I tried to uninstall it, the uninstall failed and the program would not run at all. After trying numerous procedures, I used System Restore out of desperation. It restored MSE to working condition, and left no residual problems.

In retrospect, I would probably try harder to solve the problem (including a manual uninstall of MSE) before resorting to System Restore. But my one and only experience with it was successful.

This was not, of course, a Windows Update issue (although MSE seems to hook into WU in some fashion), so I can’t speak directly to that.

Reply | Quote

yes it works, theres always some mopping up afterwards and yes it does leave traces of the errant update. It can only work effectively if you have the tools and know exactly what the problem is and how to fix it. Ultimately its a “catch 22” can you live with the aftermath? ie not the same as before or do you go with back up the data backup and re-install? and what the MVPs dont mention some updates purely and simply refuse to uninstall, and was it the update that was the problem? it may well be that other software/apps dont play “nice” it could be anything from a string of rogue code to basic incompatibility. So many scenarios, so many combinations. Even M$ cant plan for them all.

Reply | Quote

I have had good luck using System Restore with Win 7, but I have not used it for recovering from an update that failed to install. It does seem to work very well for undoing updates that installed successfully. Let me relate two examples of interest.

I wanted to see what impact telemetry gathering would have on my machine, to make a decision about joining Group A or B. So as an experiment, I unhid KB2952664 and KB3150513 and installed them. Then I used Process Explorer to monitor system activity as my laptop started up. I learned that a new process, CompatTelRunner.exe, would now run during this time, consuming a great deal of the processor for a considerable time. It is even more intrusive than TrustedInstaller. So I decided that Group B is for me, and used System Restore to undo the experiment. It worked great.

I also used System Restore when GWX first reared its ugly head last year. That was back when I used to install updates without thinking. When I saw that GWX icon the first time, I freaked out. I did not waste any time trying to figure out which update did it. I simply applied System Restore, and blew it all away. Then I did my homework, hid KB2952664 & KB3035583, and never had any trouble with GWX again. Later, I applied Ed Bott’s registry fixes to prevent Windows 10 installation, just to be safe.

So I really like System Restore. But I cannot speak to the case where an update fails to install properly.

Reply | Quote

I’ve had to use it to rollback a bad update on several machines over the years…it’s always “worked” in that regard and restored the ability to use the machine without blue screening or crashing or whatever.

Reply | Quote

When SR works, it works very well – it’s saved my bacon many times. But you cannot trust it to work every time, so you use it as the last resort before committing to a re-image/update/re-install job.

Cases where it usually succeeds: bad drivers that BSOD the system, odd third party software that broke DLL hell rules, non kernel patches from MS.

Cases where it almost always fails: MS patches that touch the kernel. Malware/Virii …

~ Group "Weekend" ~

Reply | Quote

Just to clarify, System Restore is what I am talking about above. The System Image that you can optionally snap during Windows Backups is – in my experience – highly reliable. Just in case anyone gets confused between the two. 😀

~ Group "Weekend" ~

Reply | Quote

well I for one if wanting to remove a patch would uninstall that patch rather than use System Restore which would only be a last resort if whatever was causing a problem could not be dealt with any other way. And I’m probably not alone in thinking this way…….Just my two bits……… LT

Reply | Quote

🙂

Reply | Quote

I got a corrupted file message last time I tried a system restore (ckdsk seemed to fix it).
Used it many times over the years to back out of problems.
Also use Iolo system mechanic which generally seems to take care of my windows unknown unknowns.

Reply | Quote

Good idea,
I use clonedisk about once a month to create a complete disk image. It’s much easier to restore an already setup system in the event of an unrecoverable error. Also, I don’t have the re-installation disk for my 64bit Pro version of W7, so I’ll avoid re-installation and activation issues.
While it may seem extreme, it is easy to do and I can create or restore faster than an update check 🙂

Reply | Quote

I have always disabled System Restore the moment I finished installing a new copy of Windows (all versions), as I don’t trust it.

I always believe a re-image will be much better if I encounter a major problem. I use Acronis True Image for this purpose. I don’t save any important data on my boot drive so with a re-image I won’t lose any important data.

Hope for the best. Prepare for the worst.

Reply | Quote

just an addendum to the previous post (above) the latest ie11 cumm. update kb3185319 doesent show up in the installed updates so make sure you delete the right ie11 in the installed updates otherwise if you roll back youll find your self running ie8 again, kb3185319 has an annoying habit of scrambling the “Favicons short cuts” and struck on a few desktop s/cuts too and for “finale” insists on giving you a file warning if you execute a IE shortcut from the favourites folder, inside the browser and desktop shortcuts (if you get them back) are ok win7x86.

win7x64, win8.1×64. just get the nag msg about opening files. GPOL and IE11 settings cant remove it yet to find a solution here (hence the late night) 🙁

Reply | Quote

System Restore?

I turned that as soon as a I got a good system imaging program: Disk Snapshot

Reply | Quote

and this will fix the IE11 nag msgs for all above

http://answers.microsoft.com/en-us/windows/forum/windows_10-security/a-warning-popup-when-opening-any-url-file-in/8142f4b7-6678-4670-a59b-f01b89860dac?auth=1

night all 🙂

Reply | Quote

Never used it, never will 😀

Reply | Quote

System Restore is reliable IMO, but why mess with it if you can simply uninstall an update?
Main point of SR use for me is to escape from corrupted user profiles (log in to temp profile / “The trust relationship between this workstation….”) on Vista / W7.

Reply | Quote

“System Restore is reliable IMO, but why mess with it if you can simply uninstall an update?”

Why? Because it’s not at all uncommon for an update to not install properly during the process and when that happens it normally doesn’t appear in the list of installed updates to uninstall it.

This has been the case in every instance I’ve ever encountered while reviving systems that “crashed” because of an update, and System Restore worked flawlessly every time.

As a side note, every time I’ve had to revive a system that crashed from an update it was on a system that was set to automatically install updates and in almost every instance the users just clicked the “Restart Now” prompt while other programs were still running.

Reply | Quote

The debate as to whether or not Windows System Restore is a viable restore alternative has waged on for years. Supporters say it’s a fast and efficient restore (compared to disk imaging and other similar utilities); while opponents argue that it is incomplete, often not being able to restore everything. Which is true when you consider how little WSR actually restores.

In my experiences I’m in the latter category. WSR has failed me plenty of times in regards to not being able to restore everything, and I’ve often had restore points wiped out entirely.

I disabled WSR a while ago and went with a 3rd party alternative (Rollback Rx). It does the same basic function but is more reliable imo.

Reply | Quote

Many thanks to all of you for your thoughtful responses to my question. I have been very lucky (well, and very careful) and have not had any problems with updates yet. Mostly I’m just trying to get a handle on what to do if/when it happens.

I do a full image backup on a regular basis, which has saved me from other problems, and it looks like that’s the most dependable option there is.

I haven’t actually used SR at all in years — the last couple times I tried it just didn’t ‘go’. I think I’ll go in and turn it off like 007 suggested. It’s a space waster anyway unless you continually delete old SR points.

Reply | Quote

The last time I restored a “system restore point” was when for some unknown reason my Win7/64 would not recognize my CD Rom drive.

This was after trying numerous options (driver updates), deleting it in hardware, moving it to another available connection.

I do two archived True Image Disk backups a month, but have only had to resort to those 2 times in five years and one of those times had to re-license my store purchased copy of Win7/64 premium.

I expect that Registry backups, System Restore points and Disk Images might be more important in the future depending on how MS forces/implements cumulative updates and whether I’m satisfied with my options for security updates.

The usage of an SSD 500gb drive as “C” has made image backups (two) a less than 20 minute process with Acronis True Image on about 220gb used drive. 🙂

The thing that really bugs me is how MS seems to be doing everything in its power to make Win7 as difficult as possible to maintain, such as periodically requiring the installation of specific patches for update to complete in a reasonable time.

I’d really like to see someone go after them legally for that decision.

MS has used up any goodwill that they had with me in the last year or so with their practices and for the first time made me serious consider using another OS or dual-boot.

I build my computer from scratch and have been doing so since I was excited about installing a separate math co-processor on a motherboard 🙂

I can play every game I was really into in past years on Win7 or XP Mode (which I do infrequently) and every past program that I paid for before they started going to subscription models.

Reply | Quote

Had that exact same thing happen to me, but I found that I had inadvertently caused the problem by not restarting one of the two services that Canadian Tech told us to stop and then restart after another problem was corrected. When I restarted that service and restarted my computer, things went smoothly again.

Reply | Quote

“It can only work effectively if you have the tools and know exactly what the problem is and how to fix it.”

That’s the catch for me. How many non-computer-professionals (like me) *have* all the tools and know-how? It’s a pretty simple process to return your computer to a good state from a full image backup.

Reply | Quote

“The thing that really bugs me is how MS seems to be doing everything in its power to make Win7 as difficult as possible to maintain…” Since the introduction of Windows 10, MS has been working every angle to get folks onto it. Maybe I’m being overly suspicious, but it seems that this is part of that strategy.

“MS has used up any goodwill that they had with me in the last year or so with their practices and for the first time made me serious consider using another OS or dual-boot.” I’m with you on this. I’ll keep my Win7 machine running as long as I can, then I’m off to Mac or Linux.

Reply | Quote

This (NetDef’s)is pretty much my experience too. It’s worth a try at first, but make a weekly image. Good experiences uninstalling 3rd party software that’s hosed things up. Best to have 2 if you can afford the drives; one is 2-3 weeks old and the other is 1-7 days old. As Regan use to say: “Trust, but verify.”

Reply | Quote

I may have to look at alternative disk imaging software as I have a feeling system restore and system image will be getting patches to break them from MS in the near future, just like everything else.

As you say, it’s simple to do and it also saves re-activation.
🙂

Reply | Quote

I avoided to comment in this thread until now, because I don’t use System Restore. I disable System Restore among the first things when I come across a new installation as part of my own tuning procedures. It may not be the best thing to do, but it seems that Microsoft’s engineers reached the same conclusion for Windows 10, where it appears to be deprecated.

There are few reasons.
First is that I don’t consider System Restore as useful as many users believe and for those who insist on relying on this tool, it should be like in the first reply from @Seff, ie. the last resort. I consider reinstalling in upgrade mode a far better option. This is not as scary as it sounds, because it is exactly what Windows 10 does when a new major release is installed.
The second reason and this is probably more important for me, is that System Restore fills the disk with hidden Shadow Copies which can be seen only by changing permissions on the hidden folder System Volume Information which I don’t recommend and I don’t do it myself either. The official way to administer those hidden copies is by using vssadmin. Just launch it as Administrator to see what it is about. Windows 7 well maintained and with data elsewhere than drive C should not take more than about 30 GB of space, even with 200+ patches. In practice we see disk space of 100GB+ in use and many times a lot of it is due to System Restore.
Related to the issue of writing on disk excessively, is that it not only fills the disk, but impacts the performance of the operating system while writing.
Someone else mentioned SSDs which ideally should be protected from excessive writing although it is no longer a big issue with modern SSDs. They are likely to be replaced before they physically become defective.
I actually even defrag SSDs occasionally against mainstream advice. I am not the only one http://www.hanselman.com/blog/TheRealAndCompleteStoryDoesWindowsDefragmentYourSSD.aspx

Reply | Quote

The German one? http://www.drivesnapshot.de/en/
That one is an exceptional piece of software. Very rare these days, rivalling in efficiency of how it was written with Steve Gibson’s tools https://www.grc.com/intro.htm

Reply | Quote

I haven’t chosen to use System Restore often, but in the few times I have, it has succeeded when I have rebooted into the WinRE environment and initiated the system restore from there.

Also, don’t forget that making volume snapshots (which is what System Restore does) also yields points from which you can restore files using the Previous Versions feature.

-Noel

Reply | Quote

By the way, knowing that an SSD-based file system can still benefit from an occasional (e.g., yearly) defrag is a sign of deep knowledge.

-Noel

Reply | Quote

System Restore is interfered with by your security software. Usually, if you go into safe mode to do a restore, it will work just fine, mostly

One additional point:
The default restore point space allotment in Windows 7 is 1 to 3% of drive capacity. In almost all cases, the computer is using a very small proportion of the space available. That makes it very practical to raise that 3% to say 8 to 10%. This strategy will yield far more restore points that will give you much more flexibility in recovering a bad situation.

To change the allotment, type create in the text box above the start globe. Choose Create a restore point. Click configure. Move the slide to the right as much as you see fit. Setting it at 50 Gigabytes will have no affect if you have a 500 Gigabyte drive and are only using about 100 or so, which is highly typical.

CT

Reply | Quote

“Also, don’t forget that making volume snapshots (which is what System Restore does) also yields points from which you can restore files using the Previous Versions feature.”

I didn’t realise that this is possible with Windows 7 and always thought that this is a feature of the Server OS.
Thanks.

Reply | Quote

“Usually, if you go into safe mode to do a restore, it will work just fine, mostly.”

It’s the “usually” and “mostly” in this statement that loose me. I’m not a programmer, but I use my computer a lot, and I just want it to work. So I’m more likely to use a solution that I can depend on than one that “usually” works. For now at least, that means a full image backup that I can revert to in an emergency.

Reply | Quote

Every time I have had to use System Restore it worked.

However, I also have full system backups(weekly) and incremental back ups of critical data daily both locally and on independent media and daily updates of the most critical data in the cloud. I have never had to use them, but I keep doing it because there were times before I followed this protocol that I had situations where having those kinds of backups would have been useful, and I know that if I ever stop making those backups, that is exactly when a problem will occur.

Reply | Quote

Just pick up a copy of Macrium Reflect (FREE) and an external USB drive with enough storage space to hold at least several full system images. http://www.macrium.com/reflectfree.aspx

I have not relied on System Restore since the early XP days …

Reply | Quote

By usually and mostly I am referring to differences in the way your particular security software works. Once you figure out how it works, you can dependably use restore. At least that has been my experience.

CT

Reply | Quote

I *have* had to do a full restore when my computer refused to boot one morning with no warning and I never knew why.

Reply | Quote

OK, that makes sense. But since I’m a user not a programmer, it doesn’t change my approach. Figuring out the details of how that might play out would take more time and energy than I’m willing to invest, since I already have a dependable solution in hand.

Reply | Quote

Definitely maybe! It’s worked for me in the past once or twice, but I don’t depend on it alone. When something major comes up I’ll make a disk image backup with Clonezilla first. Clonezilla hasn’t failed me, YET!

Reply | Quote

All this talk of images reminded me to make a new one which I tried to do yesterday. I use Macrium Reflect and have been for quite sometime now successfully, even have it on boot up….. (if that’s the expression) Anyway yesterday Macrium told me I needed to do a Chkdsk C /r because of some broken clusters…
which I then attempted to do, but Chkdsk wouldn’t oblige even when I scheduled it on reboot. So went looking for fixes and solutions. Tried several to no avail. Also did a system file scan. Eventually managed to do a chkdsk in Safe Mode under repair, which told me I had no problems – everything was correct. Back to Macrium who still told me I had MFT corrupt Error 6. I then thought to just mull this over, and my defrag (Auslogics) caught my eye and I ran a defrag. Haven’t got back to Macrium to see if it works now. Having a bit of ‘think’time. Seems alot have problems with Chkdsk as there is heaps written about it. any thoughts would be welcome! It used to be far easier in XP from memory.

Wanted to also say thank you Walker for your nice remark earlier on…….. nice to read! And whilst I was reading up on my problem I came across this and thought to share:

“When I was young I was sure of everything; in a few years, having been mistaken a thousand times, I was not half so sure of most things as I was before; at present, I am hardly sure of anything but what God has revealed to me”
~ John Wesley
LT

Reply | Quote

Yes, I use system restore too (with the free tool “Restore Point Creator” _by Tim Parkison_ , but once in a while this is not good anough to get the system back as it ought to be. M$ always had ‘wisely’ changed some keys in the registry; what keys an for what reason?? it’s often a mistery, and these are always keys that one is not able to see or change….
Than it’s always handy to have a full (including the BootRecords and the MasterBootRecord) system partition image. Much easier to restore from with a cup of coffee or so, in stead of searching for the nearly-impossible what to change -and that usually takes hours-.
regards

Reply | Quote

Your first next thing should be to check the disk drive itself. Download and run your hard drive manufacturer’s drive tester software.

CT

Reply | Quote

@Lizzytish: You are most welcome! Thank you as well for the quote from John Wesley! I would agree with that as being most apropos to my outlook. Thank you for sharing that. I thoroughly enjoyed it. 🙂

Reply | Quote

Thank you for the tip Canadian Tech. I am now heaving huge sighs of relief……… I ran the tests on the disk (it was a WD on an Acer laptop) and it came up two PASSES one for Quick and then Extended Tests. My feeling has been that it’s Chkdsk that’s the problem……. but how to fix it. If anyone has any ideas I’d be most grateful to hear about them.
I’ve checked the Registry setting, also the size of the Autochk.exe in System32. Chkdsk works when you just run it in Command Prompt. It comes up with results but then says it can’t go further in just read only, so then of course you include either ‘f’ or ‘r’ in the command and it then tells you you’ve got to schedule it to run on reboot. And that is when nothing happens when you reboot. Some say it’s the Antivirus prog, but you can’t stop it on reboot, and I don’t think it really is the case, but you’ve got to try all these things don’t you. I even checked the file size between a previous image of my system I have and they were the same….I read somewhere else it was a programme called Computrace that knocked out Chkdsk : https://c0d3h4x0r.wordpress.com/2009/04/09/computracelojack-for-laptops-rcpnetp-exe-rpcnetp-dll-autochk-exe/
And so it goes on…….. I’m calling it a night….. been a busy day with one thing and another without all this……… and maybe something will dawn on me…… or it will just go away by itself (wouldn’t that be lovely…… but can’t see that happening…….. as they say pigs will fly!) but I’m so relieved to find out that its not the health of my disk that’s the problem.
Big, big sighs of relief!! LT

Reply | Quote

One lesson I learned a long time ago.

If you have a full security suite installed, uninstall it, then diagnose.

I found myself searching for hours on end. Once I removed that software, things became very clear.

I will not even consider working on a problem PC until it is removed.

I insist on AV only products on my clients’ computers.

CT

Reply | Quote