One of the biggest problems computer users have to face is what happens if my operating system crashes and I have to reinstall it? If you do a straight re-installation, everything will be reset to the default values which means most of your applications will not work without being re-installed too. In most cases you will lose most, if not all, all of the files you have created unless you have them backed in a location other than My Documents.

In the past, the only way to insure that you would not have to reinstall all of your applications in the event of needing to reinstall the operating system was to use a utility like ghost to make a bit by bit copy or image of your hard drive. Bit copying can be done independent of the computer operating system. That means that it will restore the system exactly as it was at the time of imaging. There are two downsides to this method: First, it requires a good deal of technical knowledge to create and restore images, which eliminates most users. Second, all changes made since the hard disk was imaged are lost unless they have been backed up to another location.

System Restore to the Rescue

The system restore option available in XP and Vista lets administrators restore computers to a previous state without losing personal data files such as word documents, graphics, email, etc. which is what differentiates system restore from normal backups. The program runs automatically and creates restore points that can be selected if needed. Administrators can also create their own manual restore points. The most amazing thing is that the program does not seem to cause any slow down of the computer primarily because the restore points are created during periods of system idle time normally every 24 hours. You must be logged in as an administrator to access and use the system restore program.

Does System Restore Maintain Passwords?

The answer is yes and no. The restore program does the following:

Passwords that are restored

• Program such as Windows Messenger, AOL Messenger, Yahoo! Messenger, and other Web server-based passwords are restored.
• Domain and computer passwords are cached and restored by System Restore.

Passwords that are Not Restored

• Windows XP passwords and password hints
• Microsoft Internet explorer and content advisor passwords

What else is restored?

• Registry
• Local User Profiles
• COM+ DB
• WFP.dll cache
• WMI DB
• IIS Metabase
• File types monitored by System Restore as specified in the SDK document

What else is not restored?

• DRM settings
• Passwords in the SAM hive
• WPA settings (Windows authentication information is not restored)
• Specific directories/files listed in the Monitored File Extensions list in the System Restore section of the Platform SDK
• Any file types not monitored by System Restore
• Items listed in both Filesnottobackup and KeysnottoRestore keys in the registry
• Contents of redirected folders

Disabling System Restore

System restore is turned on by default. However, sometimes it is necessary to disable system restore to do system maintenance such as virus checking, etc. In fact, Microsoft recommends turning off system restore when doing virus, spy ware and other malware repairs. The steps for disabling system restore are:

Windows XP (pictured above)

• Select Start.
• Right-click the My Computer icon and select Properties
• Open the System Restore tab.
• Check Turn off System Restore or Turn off System Restore on all drives
• Select Apply.
• When turning off System Restore, the existing restore points will be deleted. Select Yes to do this.
• Click OK.
• Perform the virus removal, etc. when you have finished, restart the computer and reverse the above steps.

Windows Vista

• Select Start.
• Right-click the My Computer icon and select Properties

• Select System Protection under the Tasks column on the left side
• Select Continue on the User Account Control window that opens
• Under the System Protection tab, select Available Disks
• Uncheck the box for any drive you want to disable the system restore
• When turning off System Restore, the existing restore points will be deleted. Select Turn System Restore Off to do this.
• When turning off System Restore, the existing restore points will be deleted. Click “Turn.

• Click OK.

• Perform the virus removal, etc. when you have finished, restart the computer and reverse the above steps.

Conclusion

System Restore is a welcome utility for administrators. However, like all new features, this one needs to be tested to see exactly what is and isn’t restored on an actual machine before you rely on it to restore computers to avoid any unpleasant surprises.