On July 19, 2024, a significant incident unfolded in the tech world, marking a day that network administrators will not soon forget. At precisely 12:09 AM Eastern Daylight Time, a staggering 8.5 million Windows PCs, including devices from half of the Fortune 500 companies and the leading U.S. cybersecurity agency, fell victim to a catastrophic failure. The infamous Blue Screen of Death reared its head, sending machines into relentless reboot loops. The only recourse for beleaguered IT teams was to physically access each machine, reboot it into the Windows Recovery Environment, and eliminate the problematic CrowdStrike file responsible for the chaos. It wasn’t until three days later, on July 22, that CrowdStrike released an automated remediation tool to alleviate the situation.
In the aftermath of this debacle, Microsoft pledged to enhance Windows’ resilience against such failures. The first of these enhancements, Quick Machine Recovery, was introduced nearly a year later. Now, as we approach the second anniversary of that tumultuous day, Microsoft has unveiled a new recovery feature available across all Windows editions: Point-in-time Restore. This addition is poised to be a game-changer.
What is it?
Point-in-time Restore addresses a long-standing dilemma faced by PC users: the frustration of encountering unexpected crashes after seemingly innocuous actions. Imagine wishing for an “Undo Today” button when your system goes awry. This feature serves precisely that purpose, allowing users to revert their PCs to a previous state when everything was functioning smoothly. The beauty of Point-in-time Restore lies in its simplicity; once enabled, it operates seamlessly in the background without requiring user intervention.
Having been in preview, Point-in-time Restore was officially released to public builds of Windows at the end of June. Utilizing the Volume Shadow Copy Service, it generates daily snapshots of the entire system—operating system, applications, settings, and files—capturing the state of the PC at a specific time. By default, it retains the three most recent snapshots, ensuring users have multiple recovery options at their disposal.
These shadow copies are designed to be efficient, consuming minimal disk space. Typically, the feature occupies only 2% of the system drive, and since it shares storage with the system reserved feature, users may not even notice a significant change in available space. For instance, on a test PC with a 128 GB system drive, two restore points utilized just 2.2 GB, while a more heavily used machine with a 700 GB drive saw three restore points taking up approximately 9 GB.
To utilize a restore point, users must boot into the Windows Recovery Environment, which activates automatically after three consecutive failed startups. From there, selecting the Troubleshoot option leads to the Point-in-time Restore feature, guiding users through the necessary confirmations and, if applicable, entering a BitLocker recovery key. The restoration process typically takes between 30 to 45 minutes, depending on the hardware.
How is it different from System Restore?
System Restore, a feature dating back to Windows Me in 2000, still exists in the legacy Control Panel of Windows 11, often disabled by default. While it creates snapshots during driver installations and Windows updates, it allows for manual restore points as well. However, the snapshots generated by System Restore are less comprehensive than those created by Point-in-time Restore. The latter impacts the entire system, including data files, meaning any locally saved files created after the restore point will be lost. In contrast, System Restore preserves document files.
Point-in-time Restore is designed for ease of use, requiring minimal attention from users, and is typically enabled by default. However, both features can coexist, providing users with additional layers of recovery options.
How to turn on Point-in-time Restore
For users with a system drive of at least 200 GB, Point-in-time Restore is automatically enabled in retail or OEM editions of Windows Home or Pro. For those with smaller drives, the feature can be activated manually by navigating to Settings > System > Recovery and selecting the “View or edit” button next to Point-in-time Restore.
In Windows 11 Enterprise edition, the feature is disabled by default and may require administrative approval to activate.
How to configure it
Point-in-time Restore is set to utilize 2% of the system drive by default, sharing this space with the reserved storage feature. Users may not notice any significant change in free space due to this design. The feature intelligently manages disk usage, discarding older snapshots when necessary. However, options to adjust the frequency of snapshots and the number of retained snapshots are currently limited to Windows 11 Enterprise edition.
Are there any gotchas?
Point-in-time Restore is crafted to be user-friendly, allowing even those with limited technical knowledge to navigate the process. However, one potential hurdle arises when users must enter the 48-digit BitLocker recovery key if their system drive is encrypted. While future updates may enable remote management of restore operations through Microsoft Intune, this capability is not yet available.
The most significant consideration is the risk of losing unsaved work when applying a Point-in-time Restore snapshot. Users receive clear warnings about the implications of this action, but it may still come as a surprise to those who have not saved important files to the cloud. Once the restore operation is executed, reversing it is not straightforward. Nevertheless, in scenarios where the feature is needed, the loss of a few hours of work may pale in comparison to the broader issues at hand.
