This tutorial will show you how to use the point-in-time restore feature to restore your Windows 11 PC to the exact state it was at an earlier point in time using restore points.
Starting with Windows 11 build 26220.7271 (Dev and Beta 25H2), Microsoft introduced point-in-time restore for Windows. This flexible recovery feature empowers you to quickly roll your device back to a previous state—helping minimize downtime and simplify troubleshooting when disruptions strike. Whether you’re dealing with a widespread outage or a one-off issue, point-in-time restore helps recover your system (including apps, settings, and user files) to get you back to productivity faster.
Point-in-time restore enables users to restore a Windows PC to the exact state it was at an earlier point in time in minutes, using restore points. Restore points are stored locally on the machine and are captured using Volume Shadow Copy Service (VSS). Point-in-time restore focuses on fast recovery from recent issues by restoring the full system state captured within the last 72 hours. This feature is designed to help minimize downtime and simplify remediation, without the need for technical expertise or lengthy troubleshooting.
Restore points are captured automatically at a frequency (default: 24 hours) which is configurable by administrators. Restore points are comprehensive and include the OS, apps, settings, and local files (no user data is scoped out of the restore point). All restore points are stored locally on the system and are captured in the background.
Creation window: When point-in-time restore is enabled or settings change, the scheduler plans the next restore point based on boot timing and the most recent restore point. If there’s no recent restore point, one is scheduled promptly after enablement.
Retention: Each restore point is retained for a maximum of 72 hours; after that, it’s automatically deleted.
Deletions: Restore points are deleted, starting from the oldest restore point under the following conditions:
The max VSS storage configured for restore points is exceeded.
The device reports low free space conditions that cause VSS to limit or evict restore points.
If VSS encounters a condition that will prevent it from preserving data that is about to be overwritten all restore points are deleted. For example, the disk full, fails to allocate memory, inability to expand diff area in time, write errors.
While both point-in-time restore and System Restore use Volume Shadow Copy Service (VSS) to revert a device to a previous state, point-in-time restore introduces a modern approach and focuses on reliability and a broad range of issues.
Criteria
Point-in-time restore
System Restore
Configuration
System settings
Control panel
Restore point trigger
Scheduled frequency (automatic only)
Event-triggered or manual
Retention
Max 72 hours per restore point
Indefinite (subject to disk usage/cleanup)
Target scope
Full system state
System files and settings; app/user data coverage varies
Management
Will support remote management*
No modern management
* Remote management isn't supported in preview version
Administrators can configure the feature. The configuration options consist of:
Feature On/Off, if feature is ON, restore points are automatically captured.
Restore point frequency controls how frequently restore points are created.
Restore point retention defines how long restore points can exist on the system before they are automatically deleted (earlier deletion can occur under storage pressure).
Maximum usage limit sets an upper bound for the total space consumed by all restore points captured by VSS on the device. Space isn't pre-allocated for restore points; any remaining space within the maximum usage limit not used by restore points is available to be used by the system.
Configuration details for preview are outlined:
Configuration
Defaults
Options
Feature On/Off
On
On, Off
Restore point frequency
Every 24 hours
4, 16, 12, 24 hours
Restore point retention
72 hours
6, 12, 16, 24, 72 hours
Maximum usage limit
2% of disk
Percent of disk (min 2GB, max 50GB equivalent)
Risks
Data loss: point-in-time restore is a comprehensive recovery solution that reverts the entire system—including user files, applications, settings, passwords, secrets, certificates, and keys—to the selected restore point. Any local changes made after the restore point will be lost. Data stored in cloud services such as OneDrive isn't affected.
The capture of a restore point can fail due to insufficient disk space, system experiencing heavy I/O load, or unstable VSS writer.
The restoration of a system can fail due to insufficient free disk space, EFS-encrypted files changing, sudden power during restoration, or a corrupted file system.
Certain configurations, data corruption, or powering off the PC can prevent a successful boot after rollback as that could leave the device in a corrupt state.
Restoring the system can revert recent security updates or policies; validate and remediate post-restore.
Limitations
A restore can only be initiated locally in WinRE.
BitLocker recovery key is required for local restore on encrypted volumes.
There's no guarantee a restore point is captured at the exact frequency configured due to conditions such as: the device is powered off, in sleep or modern standby mode, recent reboot, or disk is full.
If the PC’s edition change, for example, from Home to Pro or Enterprise, point-in-time restore shouldn't be used. Restoring across different editions/SKUs can lead to system instability or unsupported configurations.
Usage of EFS encrypted files may affect reliability of point-in-time restore.
For devices that have multiple volumes, only the MainOS volume is restored.
Export/mount of restore points as independent images isn't supported.
References:
Point-in-time restore for Windows
documentation for point-in-time restore feature
learn.microsoft.com
Scalable Windows Resiliency with new recovery tools - Windows IT Pro Blog
From isolated issues to widespread outages, new Windows recovery tools help minimize downtime and deliver resilience at scale.
techcommunity.microsoft.com
Here's How:
1 Boot to Advanced Startup.
2 Click/tap on Troubleshoot. (see screenshot below)
3 Click/tap on Point-in-time restore. (see screenshot below)
4 Enter the BitLocker recovery key if the OS drive is encrypted by BitLocker or Device Encryption. (see screenshot below)
5 Click/tap on an available restore point to restore PC to the exact state it was in at the time of the restore point. (see screenshot below)
6 Click/tap on Continue to acknowledge the risks and limitations. (see screenshot below)
7 Click/tap on Restore to start the restore process. (see screenshot below)
8 Point-in-time restore will now start preparing and restoring your PC. (see screenshots below)
9 Once the restore is complete, the PC will boot back to Windows 11 for you to dismiss the lock screen and sign in. (see screenshot below)
That's it,
Shawn Brink
Related Tutorials
Enable or Disable Point-in-time Restore in Windows 11
Change Restore Point Frequency for Point-in-time Restore in Windows 11
Change Restore Point Retention for Point-in-time Restore in Windows 11
Change Maximum Disk Usage Limit for Point-in-time Restore in Windows 11
Question
davidhelp 0
This tutorial will show you how to use the point-in-time restore feature to restore your Windows 11 PC to the exact state it was at an earlier point in time using restore points.
Starting with Windows 11 build 26220.7271 (Dev and Beta 25H2), Microsoft introduced point-in-time restore for Windows. This flexible recovery feature empowers you to quickly roll your device back to a previous state—helping minimize downtime and simplify troubleshooting when disruptions strike. Whether you’re dealing with a widespread outage or a one-off issue, point-in-time restore helps recover your system (including apps, settings, and user files) to get you back to productivity faster.
Point-in-time restore enables users to restore a Windows PC to the exact state it was at an earlier point in time in minutes, using restore points. Restore points are stored locally on the machine and are captured using Volume Shadow Copy Service (VSS). Point-in-time restore focuses on fast recovery from recent issues by restoring the full system state captured within the last 72 hours. This feature is designed to help minimize downtime and simplify remediation, without the need for technical expertise or lengthy troubleshooting.
Restore points are captured automatically at a frequency (default: 24 hours) which is configurable by administrators. Restore points are comprehensive and include the OS, apps, settings, and local files (no user data is scoped out of the restore point). All restore points are stored locally on the system and are captured in the background.
- Creation window: When point-in-time restore is enabled or settings change, the scheduler plans the next restore point based on boot timing and the most recent restore point. If there’s no recent restore point, one is scheduled promptly after enablement.
- Retention: Each restore point is retained for a maximum of 72 hours; after that, it’s automatically deleted.
- Deletions: Restore points are deleted, starting from the oldest restore point under the following conditions:
- The max VSS storage configured for restore points is exceeded.
- The device reports low free space conditions that cause VSS to limit or evict restore points.
- If VSS encounters a condition that will prevent it from preserving data that is about to be overwritten all restore points are deleted. For example, the disk full, fails to allocate memory, inability to expand diff area in time, write errors.
While both point-in-time restore and System Restore use Volume Shadow Copy Service (VSS) to revert a device to a previous state, point-in-time restore introduces a modern approach and focuses on reliability and a broad range of issues.Administrators can configure the feature. The configuration options consist of:
- Feature On/Off, if feature is ON, restore points are automatically captured.
- Restore point frequency controls how frequently restore points are created.
- Restore point retention defines how long restore points can exist on the system before they are automatically deleted (earlier deletion can occur under storage pressure).
- Maximum usage limit sets an upper bound for the total space consumed by all restore points captured by VSS on the device. Space isn't pre-allocated for restore points; any remaining space within the maximum usage limit not used by restore points is available to be used by the system.
Configuration details for preview are outlined:Risks
Data loss: point-in-time restore is a comprehensive recovery solution that reverts the entire system—including user files, applications, settings, passwords, secrets, certificates, and keys—to the selected restore point. Any local changes made after the restore point will be lost. Data stored in cloud services such as OneDrive isn't affected.
- The capture of a restore point can fail due to insufficient disk space, system experiencing heavy I/O load, or unstable VSS writer.
- The restoration of a system can fail due to insufficient free disk space, EFS-encrypted files changing, sudden power during restoration, or a corrupted file system.
- Certain configurations, data corruption, or powering off the PC can prevent a successful boot after rollback as that could leave the device in a corrupt state.
- Restoring the system can revert recent security updates or policies; validate and remediate post-restore.
Limitations- A restore can only be initiated locally in WinRE.
- BitLocker recovery key is required for local restore on encrypted volumes.
- There's no guarantee a restore point is captured at the exact frequency configured due to conditions such as: the device is powered off, in sleep or modern standby mode, recent reboot, or disk is full.
- If the PC’s edition change, for example, from Home to Pro or Enterprise, point-in-time restore shouldn't be used. Restoring across different editions/SKUs can lead to system instability or unsupported configurations.
- Usage of EFS encrypted files may affect reliability of point-in-time restore.
- For devices that have multiple volumes, only the MainOS volume is restored.
- Export/mount of restore points as independent images isn't supported.
References:Point-in-time restore for Windows
Scalable Windows Resiliency with new recovery tools - Windows IT Pro Blog
Here's How:
1 Boot to Advanced Startup.
2 Click/tap on Troubleshoot. (see screenshot below)
3 Click/tap on Point-in-time restore. (see screenshot below)
4 Enter the BitLocker recovery key if the OS drive is encrypted by BitLocker or Device Encryption. (see screenshot below)
5 Click/tap on an available restore point to restore PC to the exact state it was in at the time of the restore point. (see screenshot below)
6 Click/tap on Continue to acknowledge the risks and limitations. (see screenshot below)
7 Click/tap on Restore to start the restore process. (see screenshot below)
8 Point-in-time restore will now start preparing and restoring your PC. (see screenshots below)
9 Once the restore is complete, the PC will boot back to Windows 11 for you to dismiss the lock screen and sign in. (see screenshot below)
That's it,
Shawn Brink
Link to comment
Share on other sites
0 answers to this question
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.