How to Create, Manage, and Restore System Restore Points in Windows 11 Using PowerShell

System Restore is one of Windows’ most valuable recovery tools, allowing you to roll back your system to a previous stable state without losing personal files. While the graphical interface works well for basic tasks, PowerShell provides far greater control over creating, querying, and managing restore points — particularly when you need to automate the process, script it into deployment pipelines, or troubleshoot restore point issues that the GUI cannot surface.

This guide covers the complete PowerShell workflow for System Restore in Windows 11: enabling the feature, creating restore points, listing and inspecting existing restore points, restoring from a specific point, and managing storage allocation.

What Is System Restore and How Does It Work?

System Restore uses the Volume Shadow Copy Service (VSS) to take periodic snapshots of your system’s state, including:

• Registry settings
• System files and protected operating system files
• Installed programmes and drivers
• Windows Update configurations
• PowerShell and system scripts in protected locations

Personal files, documents, photos, and user data are not affected by System Restore operations. When you restore to a previous point, Windows reverts the system configuration to the exact state captured in that snapshot, while leaving your personal files untouched.

Restore points are created automatically before significant system events such as Windows Updates, driver installations, and application installs. You can also create manual restore points at any time.

Checking Whether System Restore Is Enabled

Before creating or managing restore points, verify that System Restore is enabled on your target drive. Open PowerShell as Administrator and run:

Get-ComputerRestorePoint

If System Restore is enabled and restore points exist, this command lists them. If the feature is disabled, you will see an error indicating that the service is not available.

To check the protection status of specific drives:

vssadmin list shadowstorage

This shows which volumes have shadow copy storage allocated and how much space is being used.

Enabling System Restore via PowerShell

If System Restore is not enabled on a drive, you can enable it using PowerShell:

Enable-ComputerRestore -Drive "C:\"

To enable protection on multiple drives simultaneously:

Enable-ComputerRestore -Drive "C:\", "D:\"

Verify the change by running Get-ComputerRestorePoint again. Note that enabling System Restore does not immediately create a restore point — it simply activates the monitoring and snapshot infrastructure for the specified drive.

Creating a New Restore Point

To create a manual restore point with a descriptive label:

Checkpoint-Computer -Description "Before driver update" -RestorePointType "MODIFY_SETTINGS"

The -RestorePointType parameter accepts the following values:

• APPLICATION_INSTALL — marks the restore point as being created before an application installation.
• APPLICATION_UNINSTALL — marks it as being created before an uninstallation.
• DEVICE_DRIVER_INSTALL — marks it as being created before a driver installation.
• MODIFY_SETTINGS — a general-purpose type for system setting changes.
• CANCELLED_OPERATION — marks it as a rollback checkpoint.

If you omit the -RestorePointType parameter, PowerShell defaults to APPLICATION_INSTALL.

The 24-Hour Frequency Limit

By default, Windows 11 restricts the creation of restore points to one every 24 hours of the same type. If you attempt to create a second restore point within this window, the command completes without error but does not actually create a new point.

To override this restriction (useful for testing or rapid deployment scenarios), modify the following registry value:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" -Name "SystemRestorePointCreationFrequency" -Value 0 -Type DWord

Setting the value to 0 removes the time restriction entirely, allowing you to create restore points as frequently as needed. To reinstate the default 24-hour limit, set the value to 1440 (the number of minutes in 24 hours).

Listing All Existing Restore Points

To retrieve a complete list of all restore points on the system:

Get-ComputerRestorePoint

Each entry includes:

• SequenceNumber — the unique identifier for the restore point.
• Description — the label assigned when the point was created.
• RestorePointType — the numeric type code.
• EventType — whether it was the start or end of a restore operation.
• CreationTime — the date and time the restore point was created.

Filtering Restore Points by Date

To list only restore points created within the last 7 days:

Get-ComputerRestorePoint | Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) }

Filtering by Description

Get-ComputerRestorePoint | Where-Object { $_.Description -like "*driver*" }

Formatting Output as a Table

Get-ComputerRestorePoint | Format-Table SequenceNumber, Description, CreationTime -AutoSize

Exporting Restore Points to CSV

Get-ComputerRestorePoint | Export-Csv -Path "$env:USERPROFILE\Desktop\RestorePoints.csv" -NoTypeInformation

Inspecting a Specific Restore Point

To retrieve details for a specific restore point by its sequence number:

Get-ComputerRestorePoint -RestorePointId 15

Replace 15 with the actual sequence number from the list. This is useful when you need to verify the exact state captured in a particular restore point before initiating a restore operation.

Restoring from a Specific Restore Point

To initiate a system restore to a specific point:

Restore-Computer -RestorePoint 15 -Confirm:$false

This command begins the restore process immediately. The system will restart automatically to complete the restoration. The -Confirm:$false flag suppresses the confirmation prompt, which is useful for scripted or automated scenarios.

Important considerations before restoring:

• Save all open work — the system will restart during the restore process.
• Applications installed after the selected restore point will be removed.
• Windows Updates applied after the restore point will be rolled back.
• Personal files remain unaffected.
• The restore operation itself creates a new restore point, allowing you to undo the restoration if needed.

Disabling System Restore

To disable System Restore on a specific drive:

Disable-ComputerRestore -Drive "C:\"

This removes all existing restore points for the specified drive and stops the system from creating new ones. Use this with caution — you will lose the ability to roll back system changes until the feature is re-enabled.

Managing Shadow Copy Storage Allocation

System Restore uses shadow copy storage, which has a maximum size allocation. When this storage fills up, the oldest restore points are automatically deleted to make room for new ones.

Checking Current Storage Usage

vssadmin list shadowstorage

Increasing the Maximum Storage Allocation

vssadmin resize shadowstorage /for=C: /on=C: /maxsize=20GB

This increases the maximum shadow storage to 20 GB on the C: drive. Larger allocations allow more restore points to be retained, but consume more disc space.

Deleting All Shadow Copies

To remove all shadow copies (and therefore all restore points) from a drive:

vssadmin delete shadows /for=C: /all

Use this when you need to reclaim disc space urgently, but be aware that all restore points will be permanently deleted.

Automating Restore Point Creation with a Scheduled Task

You can create a scheduled task that automatically generates a restore point at regular intervals:

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -Command Checkpoint-Computer -Description 'Automated Daily Restore Point' -RestorePointType MODIFY_SETTINGS"
$trigger = New-ScheduledTaskTrigger -Daily -At "08:00"
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest
Register-ScheduledTask -TaskName "DailyRestorePoint" -Action $action -Trigger $trigger -Principal $principal -Description "Creates a daily system restore point at 8 AM"

Remember to set the SystemRestorePointCreationFrequency registry value to 0 if you need restore points more frequently than once every 24 hours.

Troubleshooting Common Issues

Restore Points Are Not Being Created

• Ensure the Volume Shadow Copy service is running: Get-Service -Name VSS.
• Verify that System Protection is enabled for the target drive.
• Check that sufficient disc space is available for shadow storage.
• Confirm you are running PowerShell as Administrator.

Restore Points Disappear After Reboot

• If you dual-boot with another operating system, the other OS may delete Windows restore points during its boot process.
• Check that the shadow storage maximum has not been set too low, causing older points to be pruned immediately.

Restore Operation Fails

• Boot into Safe Mode and retry the restore operation.
• Check the System Restore logs in Event Viewer under Applications and Services Logs > Microsoft > Windows > SystemRestore.
• Ensure no antivirus or security software is blocking the restoration process.

PowerShell’s System Restore cmdlets provide a level of automation, precision, and scriptability that the graphical interface simply cannot match, making them indispensable for system administrators managing Windows 11 deployments at any scale.