System Restore is a legacy Windows recovery feature that continuously monitors the operating system for major changes (like driver installations or Windows Updates) and creates “restore points”—snapshots of the registry and critical system files. While it provides a safety net for consumers, it is largely obsolete in modern enterprise environments that rely on immutable infrastructure, automated redeployments, or robust image-based backups. Furthermore, System Restore consumes significant disk space and can ironically be exploited by sophisticated malware (like ransomware) to hide malicious payloads within the protected System Volume Information folder.
This guide explains how to completely disable System Restore system-wide via the Group Policy Editor in Windows 11.
Disable System Restore via Group Policy
To enforce a strict lockdown that prevents standard users and the operating system itself from generating or utilizing restore points, we must apply an administrative template. Note that the Group Policy Editor is only available on Windows 11 Pro, Enterprise, and Education editions.
- Log into Windows 11 with an Administrator account.
- Press the Windows Key + R to open the Run dialogue box.
- Type
gpedit.mscand press Enter to launch the Local Group Policy Editor. - In the left-hand navigation pane, navigate precisely to this path:
Computer Configuration > Administrative Templates > System > System Restore - In the right-hand pane, locate the master policy named Turn off System Restore.
- Double-click the policy to open its configuration window.
- Select the radio button next to Enabled. (You are “Enabling” the instruction to “Turn off” the feature).
- Click Apply, then click OK.
Verify the Lockdown
Group Policy modifications apply dynamically in the background, though you can force an immediate update by opening Command Prompt and executing gpupdate /force.
To verify the restriction is active and successfully overriding the GUI, press the Windows Key, type Create a restore point, and press Enter to open the System Properties window.
Navigate to the “System Protection” tab. You will immediately notice that the entire interface is greyed out. A banner at the top of the window or across the buttons will state, “System Restore has been turned off by your system administrator.” The “Create” and “System Restore” buttons are completely unclickable, confirming that the snapshot engine is permanently disabled and your local storage is free from its overhead.