This tutorial will show you how to use the point-in-time restore feature to restore your Windows 11 PC to the exact state it was at an earlier point in time using restore points.
Starting with Windows 11 build 26220.7271 (Dev and Beta 25H2), build 29576.1000 (Experimental Future Platforms), build 26100.8728 (RP 24H2), and build 26200.8728 (RP 25H2), Microsoft introduced point-in-time restore for Windows. This flexible recovery feature empowers you to quickly roll your device back to a previous state—helping minimize downtime and simplify troubleshooting when disruptions strike. Whether you’re dealing with a widespread outage or a one-off issue, point-in-time restore helps recover your system (including apps, settings, and user files) to get you back to productivity faster.
Point-in-time restore enables users to restore a Windows PC to the exact state it was at an earlier point in time in minutes, using restore points. Restore points are stored locally on the machine and are captured using Volume Shadow Copy Service (VSS). Point-in-time restore focuses on fast recovery from recent issues by restoring the full system state captured within the last 72 hours. This feature is designed to help minimize downtime and simplify remediation, without the need for technical expertise or lengthy troubleshooting.
Restore points are captured automatically at a frequency (default: 24 hours) which is configurable by administrators. Restore points are comprehensive and include the OS, apps, settings, and local files (no user data is scoped out of the restore point). All restore points are stored locally on the system and are captured in the background.
- Creation window: When point-in-time restore is enabled or settings change, the scheduler plans the next restore point based on boot timing and the most recent restore point. If there’s no recent restore point, one is scheduled promptly after enablement.
- Retention: Each restore point is retained for a maximum of 72 hours; after that, it’s automatically deleted.
- Deletions: Restore points are deleted, starting from the oldest restore point under the following conditions:
- The max VSS storage configured for restore points is exceeded.
- The device reports low free space conditions that cause VSS to limit or evict restore points.
- If VSS encounters a condition that will prevent it from preserving data that is about to be overwritten all restore points are deleted. For example, the disk full, fails to allocate memory, inability to expand diff area in time, write errors.
Criteria | Point-in-time restore | System Restore |
|---|---|---|
| Configuration | System settings | Control panel |
| Restore point trigger | Scheduled frequency (automatic only) | Event-triggered or manual |
| Retention | Max 72 hours per restore point | Indefinite (subject to disk usage/cleanup) |
| Target scope | Full system state | System files and settings; app/user data coverage varies |
| Management | Will support remote management* | No modern management |
Administrators can configure the feature. The configuration options consist of:
- Feature On/Off, if feature is ON, restore points are automatically captured.
- Restore point frequency controls how frequently restore points are created.
- Restore point retention defines how long restore points can exist on the system before they are automatically deleted (earlier deletion can occur under storage pressure).
- Maximum usage limit sets an upper bound for the total space consumed by all restore points captured by VSS on the device. Space isn't pre-allocated for restore points; any remaining space within the maximum usage limit not used by restore points is available to be used by the system.
Configuration | Defaults | Options |
|---|---|---|
| Feature On/Off | On | On, Off |
| Restore point frequency | Every 24 hours | 4, 16, 12, 24 hours |
| Restore point retention | 72 hours | 6, 12, 16, 24, 72 hours |
| Maximum usage limit | 2% of disk | Percent of disk (min 2GB, max 50GB equivalent) |
Risks
Data loss: point-in-time restore is a comprehensive recovery solution that reverts the entire system—including user files, applications, settings, passwords, secrets, certificates, and keys—to the selected restore point. Any local changes made after the restore point will be lost. Data stored in cloud services such as OneDrive isn't affected.
- The capture of a restore point can fail due to insufficient disk space, system experiencing heavy I/O load, or unstable VSS writer.
- The restoration of a system can fail due to insufficient free disk space, EFS-encrypted files changing, sudden power during restoration, or a corrupted file system.
- Certain configurations, data corruption, or powering off the PC can prevent a successful boot after rollback as that could leave the device in a corrupt state.
- Restoring the system can revert recent security updates or policies; validate and remediate post-restore.
- A restore can only be initiated locally in WinRE.
- BitLocker recovery key is required for local restore on encrypted volumes.
- There's no guarantee a restore point is captured at the exact frequency configured due to conditions such as: the device is powered off, in sleep or modern standby mode, recent reboot, or disk is full.
- If the PC’s edition change, for example, from Home to Pro or Enterprise, point-in-time restore shouldn't be used. Restoring across different editions/SKUs can lead to system instability or unsupported configurations.
- Usage of EFS encrypted files may affect reliability of point-in-time restore.
- For devices that have multiple volumes, only the MainOS volume is restored.
- Export/mount of restore points as independent images isn't supported.
- Point-in-time restore is not a substitute for a system image.
References:
Point-in-time restore for Windows
documentation for point-in-time restore feature
learn.microsoft.com
Scalable Windows Resiliency with new recovery tools - Windows IT Pro Blog
From isolated issues to widespread outages, new Windows recovery tools help minimize downtime and deliver resilience at scale.
If you do not have the point-in-time restore feature available in the builds above yet and would like to try it now, then you can use the ViVeTool command below to enable it.
vivetool.exe /enable /id:55324166,59673297
Enable or Disable Hidden Feature Flags in Windows 11
This tutorial will show you how to enable or disable hidden experimental feature flags in Windows 11. ViVeTool is an open source tool that can be used to enable hidden features that are part of controlled feature roll-outs or A/B testing in Insider builds of Windows 11. Starting with Windows...
www.elevenforum.com
Here's How:
1 Boot to Advanced Startup (WinRE).
2 Click/tap on Troubleshoot. (see screenshot below)
3 Click/tap on Point-in-time restore. (see screenshot below)
This Point-in-time restore option will only be available in Troubleshoot if you have a restore point available.
4 Enter the BitLocker recovery key if the OS drive is encrypted by BitLocker or Device Encryption, and click/tap on Continue. (see screenshot below)
5 Click/tap on an available restore point to restore PC to the exact state it was in at the time of the restore point. (see screenshot below)
6 Click/tap on Continue to acknowledge the risks and limitations. (see screenshot below)
7 Click/tap on Restore to start the restore process. (see screenshot below)
8 Point-in-time restore will now start preparing and restoring your PC. (see screenshots below)
9 Once the restore is complete, the PC will boot back to Windows 11 for you to dismiss the lock screen and sign in. (see screenshot below)
That's it,
Shawn Brink
Related Tutorials
- Enable or Disable Point-in-time Restore in Windows 11
- Change Restore Point Frequency for Point-in-time Restore in Windows 11
- Change Restore Point Retention for Point-in-time Restore in Windows 11
- Change Maximum Disk Usage Limit for Point-in-time Restore in Windows 11
- See List of Available Point-in-time Restore Points in Windows 11
Last edited:











