Can I change automatic system protection "shadow copies" settings?

After experiencing occasional hiccups during playback of digital audio files on my internal storage drive, I did some troubleshooting and found that this glitch ALWAYS occurs at just a few seconds past 12:00 PM when I happen to be playing audio at that time. Checking Event Viewer I figured out what system event happens at the same exact time each day and found that it is "Ntfs (Microsoft-Windows-Ntfs)" with Event ID 98. See attached screenshot.



I posted on the users forum for the audio software I use for music playback (JRiver Music Center) and was given a link to this page explaining what it is that is happening automatically at the same time every day: Windows Shadow Copies Explained: Restore Deleted Files Without a Backup Drive | Optimised Computing — Optimised Computing

That page explains the purpose and value of this setting in creating automatic system restore points and tells me how to turn it on or off. I can get rid of the glitch in my music listening by turning it off as instructed, but then I have to turn it back on again or else I will not get the benefit of this system protection feature if I just leave it off. Looking at the options given I can only turn on system protection (which will automatically scan the OS drive at 12:00:00 every day), or disable the feature entirely.



What I would like to do is to change the scheduled time for this event to occur daily. 12:00 PM is a time of day I am often listening to music on my computer and I hate it when the glitch or hiccup happens during a song. Can I change the scheduled time for this automatic background event from 12:00 PM to 8:00 AM for example, since that is a time my computer is always on and I am not playing music at that time as a rule?

Are you referring to Point in time restore? If so, it can be turned off or you can change the frequency of when point in time restore points are created. . I make regular images so I do not use point in time restore at all. I have it disabled. As for system restore. the only time my system automatically creates a system restore point is before a windows update is applied.

But you need to understand the difference in system restore points and point in time restore before making your choices.

• System Restore: Saves system files, the registry, and installed programs. It does not touch or restore your personal documents.

• Point-in-Time Restore: Saves a complete snapshot of your main drive (C:). This includes Windows, apps, settings, and personal local files. If you roll back, any local files created after that time are lost

How to disable point in time restore.

OR

You can change the frequency of when windows creates point in time restore points.

glasskuter said:

Are you referring to Point in time restore? If so, it can be turned off or you can change the frequency of when point in time restore points are created. . I make regular images so I do not use point in time restore at all. I have it disabled. As for system restore. the only time my system automatically creates a system restore point is before a windows update is applied.

But you need to understand the difference in system restore points and point in time restore before making your choices.

• System Restore: Saves system files, the registry, and installed programs. It does not touch or restore your personal documents.
• Point-in-Time Restore: Saves a complete snapshot of your main drive (C:). This includes Windows, apps, settings, and personal local files. If you roll back, any local files created after that time are lost

How to disable point in time restore.

Enable or Disable Point-in-time Restore in Windows 11

This tutorial will show you how to turn on or off the point-in-time restore feature in Windows 11. Starting with Windows 11 build 26100.8737 (24H2), build 26200.8737 (25H2), and build 28000.2340 (26H1), Microsoft introduced point-in-time restore for Windows. This flexible recovery feature...

www.elevenforum.com

OR

You can change the frequency of when windows creates point in time restore points.

Change Restore Point Frequency for Point-in-time Restore in Windows 11

This tutorial will show you how to change how frequently restore points are created for point-in-time restore in Windows 11. Starting with Windows 11 build 26100.8737 (24H2), build 26200.8737 (25H2), and build 28000.2340 (26H1), Microsoft introduced point-in-time restore for Windows. This...

www.elevenforum.com

Click to expand...

So if I understand it correctly, I can only change the FREQUENCY of when restore snapshots are created. Which means that as long as the feature is enabled it will always create a snapshot at exactly 12:00 PM since that is the time it will occur if I choose once every 24 hours (or I can choose higher frequency so it does its thing at 12:00 AM, 4:00 AM/PM or 6:00 AM/PM or 8:00 AM/PM, etc... I wish I could leave the frequency at once every 24 hours but change the time scheduled from 12:00 PM to a different time of day when I will not be using the computer for tasks that will be affected by the automatically scheduled restore snapshot.

It seems to me there ought to be a way to go under the hood and change the default time from 12:00 PM to a different time of day, but I can't see a way to do that.

Ferrara said:

t seems to me there ought to be a way to go under the hood and change the default time from 12:00 PM to a different time of day

Click to expand...

Not unless @Brink knows a registry hack to do it.

If it helps, you could create your own scheduled task to create a restore point when you want.

You can view the list of tasks that Windows launches at 12:00

schtasks /query /fo LIST >E:\111.txt

Open the file in a text editor, <F3>, search by "12:00"

and disable them if you don't need them

Get-ScheduledTask "<task_name>" | Disable-ScheduledTask

this maybe of interest for those that wish to adjust PITR

best of luck Steve ..

So if I were to click the box to disable system protection in the Configure Restore Settings, then would I be out of luck if I ever needed to do a system restore? I have rarely needed to do such a thing, but obviously if I had to do that in the event of some issues, I would need a recent restore point. Whenever I had to do a system restore in the past in Windows 10 or earlier, it was due to an update of an existing app or installation of a new app that caused a problem. I could just turn the feature off, that's the simplest thing, but I wouldn't want to regret it if the time came I needed to try a system restore to fix something.

Again, by your response, I do not think you understand that system restore and point in time restore are 2 different things. Disabling point in time restore will not disable system restore, nor visa versa, Each feature is controlled by different settings..

glasskuter said:

Again, by your response, I do not think you understand that system restore and point in time restore are 2 different things. Disabling point in time restore will not disable system restore, nor visa versa, Each feature is controlled by different settings..

Click to expand...

Okay then, so that event that is shown in my screenshot for Event Viewer, "Ntfs (Microsoft-Windows-Ntfs)" with Event ID 98: What is that event referring to, is it system restore or point in time restore, and is there a way to edit that event that keeps happening every day at the same time, specifically to change the time it happens, or will disabling that feature as shown in my other screenshot prevent me from doing a system restore? I'm sorry if I am failing to grasp what is being explained to me, and that I am failing to explain my own understanding clearly.

It seems that that particular event that shows up in the Event Viewer system log each day at exactly 12:00:13 give or take a couple seconds is what is causing audio playback hiccups, and so I'm trying to determine the best way to stop that event from happening daily at that time by moving it to a different time or turning the feature off entirely?

I don't think I would ever want to do a point in time restore that messed up any changes I may have made in my own files such as edits, additions or deletions, but a system restore I might need to do in some cases.

glasskuter said:

Again, by your response, I do not think you understand that system restore and point in time restore are 2 different things. Disabling point in time restore will not disable system restore, nor visa versa, Each feature is controlled by different settings..

Click to expand...

and just to add a system restore point can overwrite a PITR restore point
i now have system restore disabled and only PITR enabled.
best of luck Steve ..

Ferrara said:

What is that event referring to, is it system restore or point in time restore,

Click to expand...

Both PITR and SR use the volume shadow copy service. Since system restore automatically makes a restore point only once ever 7 days (or before some major task like a windows update) it is a pretty good bet that PITR is what is triggering those events. You can prove to yourself it is not SR by checking the time of your system restore points.

• Press the Windows Key + R on your keyboard to open the Run dialog box.
• Type rstrui and press Enter to open the System Restore wizard.
• Click Next on the initial System Restore screen.
• Look at the list of available restore points showing date, time, and description.
• Check the box for Show more restore points in the bottom-left corner to see the system restore points and when they were made.
• Click Cancel once you finish viewing the list so you do not change your system settings

Ferrara said:

is there a way to edit that event that keeps happening every day at the same time, specifically to change the time it happens,

Click to expand...

If PITR is enabled and set to run at 4-6-12-24 hour internals PITR will run at 12:00 every day. If set at 16 hour interval, PITR will run at 12:00 every 2 days. So NO, you can not stop PITR from ever running at 12:00 if PITR is enabled.

Ferrara said:

will disabling that feature as shown in my other screenshot prevent me from doing a system restore?

Click to expand...

Disabling PITR automatic tasks will not stop system restore automatic tasks or your ability to manually make a system restore point.

Ferrara said:

I don't think I would ever want to do a point in time restore that messed up any changes I may have made in my own files such as edits, additions or deletions, but a system restore I might need to do in some cases.

Click to expand...

System Restore recovers ONLY system files, NEVER user files. Point in time recovers both system and user files to the point the PITR point was made. System restore points can not be used to recover user files.

If you are syncing your user folders to OneDrive and ever restore using a PITR point, no edits, additions, or deletions of user files will be lost since they are synced to the cloud.

If you are NOT syncing your user folders to onedrive those folders are stored only on your system drive. If you have to restore a PITR point, only the changes made after the PITR point was made will be lost.

Neither System Restore OR Point In Time restore are a substitute for making system images. Depending on what kind of recovery scenario one experiences is what recovery method is appropriate.

I don't know how to explain it better than that.

There is a very nice tool,called Quick Restore Maker (QRM) alowing to create a restore point with 1 click: Quick Restore Maker: Create a System Restore Point in 1-click
After installation, you can use this tool to create an automatic restore point with the Windows Task Scheduler. I have done so, the task is very easy to create.
It is explained here for a task to make a daily time sync (independently from the Windows time sync which is often delayed) : Make Windows synchronize time more often But don't worry, creating this last task is much more complicated than to create the restore task. Just go the the line "Task Scheduler Library" (left above in the first picture in the second link; don't go further down to "Time Synchronisation" or something else, just stay at the first level) and create a task (right menu). Then find the the exe file of QRM and paste the path into the Task Scheduler. The rest is self explaining (fill in all the fields, several tabs), especially the new time when the task should run.( If it doesn't run try to change the owner from Local Service to "your user name" or to "administrators").
Good luck

glasskuter said:

Both PITR and SR use the volume shadow copy service. Since system restore automatically makes a restore point only once ever 7 days (or before some major task like a windows update) it is a pretty good bet that PITR is what is triggering those events. You can prove to yourself it is not SR by checking the time of your system restore points.

• Press the Windows Key + R on your keyboard to open the Run dialog box.
• Type rstrui and press Enter to open the System Restore wizard.
• Click Next on the initial System Restore screen.
• Look at the list of available restore points showing date, time, and description.
• Check the box for Show more restore points in the bottom-left corner to see the system restore points and when they were made.
• Click Cancel once you finish viewing the list so you do not change your system settings

If PITR is enabled and set to run at 4-6-12-24 hour internals PITR will run at 12:00 every day. If set at 16 hour interval, PITR will run at 12:00 every 2 days. So NO, you can not stop PITR from ever running at 12:00 if PITR is enabled.

Disabling PITR automatic tasks will not stop system restore automatic tasks or your ability to manually make a system restore point.


System Restore recovers ONLY system files, NEVER user files. Point in time recovers both system and user files to the point the PITR point was made. System restore points can not be used to recover user files.

If you are syncing your user folders to OneDrive and ever restore using a PITR point, no edits, additions, or deletions of user files will be lost since they are synced to the cloud.

If you are NOT syncing your user folders to onedrive those folders are stored only on your system drive. If you have to restore a PITR point, only the changes made after the PITR point was made will be lost.

Neither System Restore OR Point In Time restore are a substitute for making system images. Depending on what kind of recovery scenario one experiences is what recovery method is appropriate.

I don't know how to explain it better than that.

Click to expand...

Thank you for that detailed response, I think I understand it now. "

• Check the box for Show more restore points in the bottom-left corner to see the system restore points and when they were made."

But there is no box to show more restore points that I can see:



I'm not going to ask about making system images since I already think I have enough info here, hopefully I do not need to do that. I think that automatic restore points with each Windows update are enough and I can create a restore point manually if I want to be safe before installing some new app.

As for file and folder backups, I still do it the old fashioned way to a 4TB Seagate external drive on a pretty regular basis (using the FreeFileSync app). Never got around to doing cloud storage and I disabled OneDrive.

Thank you all for your time and assistance, this forum is a big help to turn to when I have these kinds of questions because I can always count on trustworthy and helpful answers.

@Ferrara You're welcome. It is my opinion that with PITR, it is Microsoft's last ditch effort to help protect users from total user data loss if Windows gets really screwed up.

MS first tried with MS account/Onedrive syncing which is not popular with some (moi included). Microsoft knows that many users do not sync to Onedrive, make system images, or even regularly backup their personal folders in any shape, form, or fashion. These users are sitting ducks to lose everything if they experience hardware failure or system corruption so bad that a clean install of windows is necessary. So along came Point in Time Recovery. While PITR won't help for hardware failure, it is better than nothing if one experiences Windows corruption.....IF it works as it is supposed to when it is needed for recovery.

Only Onedrive sync, system images, or a regular backup of one's personal files can help these users get ANY of their personal files back if total disaster happens and windows has to be installed from scratch. In that case, most any user would be more than happy to sacrifice a few missing or outdated files dependent on when their image/ file backup was made.