Microsoft's Windows 11 gets 'Undo button' with new recovery tool

Windows 11 gets 'Undo button' with new recovery tool">

The memory of July 19, 2024, still sends shivers down the spines of network admins. On that day, a faulty CrowdStrike update caused 8.5 million Windows PCs to spiral into Blue Screen of Death reboot loops, disrupting operations for half the Fortune 500 and the top US cybersecurity agency. The only recovery option was for an admin to manually visit each machine, reboot it into the Windows Recovery Environment, and remove the defective file.

Microsoft promised changes to make Windows more resilient in the aftermath. The first fix, Quick Machine Recovery, arrived almost a year later. Now, as the second anniversary approaches, a new recovery feature, Point-in-time Restore, is available on all editions of Windows.

This tool solves a problem as old as the PC itself: "I don't understand. It was working fine yesterday. Then I did [some seemingly innocuous thing] and now it's crashing." Point-in-time Restore rolls back your PC to a time when it was working properly, undoing everything that happened between then and now.

The feature uses the Volume Shadow Copy Service to create a snapshot of your PC — the operating system, apps, settings, files ... everything. It takes one snapshot a day, around the same time each day, and saves the three most recent snapshots.

By default, the feature takes one snapshot a day and keeps restore points for 72 hours. Shadow copies are extremely efficient, so the feature uses relatively little disk space. By default, it's configured to use 2% of the system drive, and because it shares disk space with the system reserved storage feature, you might not even notice a change.

On one test PC with a 128 GB system drive and 8 GB of RAM, two restore points took up 2.2 GB of space. On a much more heavily used PC with a 700 GB system drive, three restore points used about 9 GB of disk space. To apply one of those restore points, boot to the Windows Recovery Environment (this happens automatically after three failed starts in a row) and choose the Troubleshoot option.

Choose the Point-in-time Restore option at the top of the menu, go through multiple confirmations, enter a BitLocker recovery key if the system drive is encrypted, and then wait while the previous snapshot is restored. On test PCs, it took between 30 and 45 minutes, but restore time could vary depending on hardware. System Restore is an ancient feature that debuted in Windows Me in 2000.

It survives in the legacy Control Panel in Windows 11, where it's often disabled by default. Point-in-time Restore affects the entire system, data files, and all, whereas System Restore doesn't touch document files at all. One of the key assumptions is that anyone using this feature is already storing important files in the cloud.