This guide demonstrates how to undo a system restore in Windows 10 and Windows 11. It explains how system restore points work and provides instructions for canceling a system restore (rolling your system back to its pre-restore state) using Windows Safe Mode and the Windows Recovery Environment (Windows RE).
What is System Restore in Windows?
System Restore takes periodic snapshots of your Windows operating system, configuration, and applications, allowing you to restore your system to a previous state in the event of a system issue. These snapshots are called Restore Points and are created automatically whenever new software, drivers, or Windows updates are installed. You can change the creation frequency for system restore points or create them manually.
System Restore is available in all versions of Windows 10 and Windows 11, and must be enabled as part of the System Protection feature (if you’re managing multiple Windows devices, you can automate this).
Restoring your system from a known good restore point allows you to roll back changes that may prevent your system from booting or functioning correctly. This includes changes made by installing or updating drivers and software or making changes to your Windows system configuration (including to the registry) and also changes that are a result of malware.
However, restore points can be created when your system is not in a stable state, or may not complete fully, leaving your Windows device unstable or unable to boot. This may make it necessary to undo a system restore.
Note that system restore does not affect the files in your user profile (including emails, your Documents, Downloads, Photos, and Videos folders, or files stored in OneDrive). It only takes snapshots of and restores files related to the Windows operating system, apps and drivers, and related configurations.
How to undo a System Restore in Windows 10 and Windows 11
System Protection must be enabled to create, restore, and undo System Restore points (it is not enabled by default). You can check whether System Protection is enabled by following these steps:
- Right-click on the Start button and select Run
- Type sysdm.cpl in the Run dialog and press OK to open System Properties
- Click on the System Protection tab
- Under Protection Settings, the status of System Protection for each drive is displayed in the Protection column
If System Protection is not enabled for a drive, you can enable it by selecting a drive from the list, pressing the Configure button, and toggling Turn on system protection.
You can also check the status of System Restore using PowerShell.
A system restore cannot be undone under the following circumstances:
- System restore was performed while in Safe Mode
- System restore was performed from the Windows Recovery Environment
This effectively means that only system restore points restored from a normal Windows session can be undone.
Note that you will need to be logged in as an administrator when using both Safe Mode and the Windows Recovery Environment to roll back a system restore. A system restore can also not be canceled/rolled back until it has been completed, and it is important that you do not interrupt the process if it is in progress. Before making any changes to your Windows device, you should make a complete backup to a separate device.
Undo a system restore using the System Restore feature
The following instructions describe how to undo a system restore from within Windows 10 or 11 using the System Restore tool:
- Right-click on the Start button and select Run
- Type sysdm.cpl in the Run dialog and press OK to open System Properties
- Select the System Protection tab and click the System Restore… button
- Select Undo System Restore (the details of the system restore that will be undone will be shown, including the time it occurred) and click Next
- Optionally, you can click Scan for affected programs and review the results
- Confirm the details for reversing the system restore and click Finish, and then confirm to restart and complete the process
Make sure that you heed the warning about creating a password reset disk if your password has recently changed — if you do not remember what your password was at the time your system will be restored to, you may need to reset it.
Rolling back a System Restore from Safe Mode
In some cases (for example, if a bad driver is preventing Windows from booting), you may need to run a system restore from Safe Mode:
- Boot your Windows device in safe mode
- Open the Run dialog by right-clicking on the Start button
- Enter the command rstrui.exe and press OK to directly open System Restore (as the System Protection tab in System Properties is not available in Safe Mode)
- Complete the steps detailed in the previous section to undo a system restore using the System Restore tool
When Windows boots in Safe Mode, only the bare minimum of system files and drivers are loaded and services are started. This may include recently installed or updated software that is preventing the system from booting normally. Running a system restore from Safe Mode to reverse the change may resolve the issue. If you cannot boot into Safe Mode, accessing System Restore via the Windows Recovery Environment may still work.
Using Advanced Startup Options/Windows Recovery Environment (Windows RE) to cancel a system restore
A system restore cannot be canceled while in progress but can be rolled back once complete. To do this from the Windows Recovery Environment:
- Boot into the Windows Recovery Environment by holding the Shift key as it boots or using a Windows recovery USB (if your system has failed to boot several times, it may automatically enter the recovery environment)
- Choose the Troubleshoot option
- Click Advanced options
- Select System Restore
- Follow the steps detailed above for using the System Restore tool to roll back to a previous point
Troubleshooting issues after undoing a System Restore
Rolling back a system restore uses the same process as restoring any system restore point to restore your Windows 10 or Windows 11 system to a prior state. This process should not be interrupted – if it fails to complete it may leave your PC in an unusable state that cannot be undone.
As you cannot reverse a system restore that was performed from the Windows Recovery Environment or Safe Mode, you should attempt to restore from a normal Windows session first. This also makes it important that you carefully choose the correct restore point when working in these environments.
It may also not be possible to perform or undo a system restore after a major Windows Update that makes significant changes to the Windows operating system.
As a last resort, you can use the Reset your PC feature of Windows 10 and Windows 11 to attempt to restore your device to its factory settings. Note that this destroys all installed programs and custom settings, but the option will be presented to preserve some user data. Failing this, a complete clean reinstall of Windows from a DVD or USB stick may be required.
Best practices for Using Windows System Restore effectively
There are several best practices that you can follow to get the most effective and reliable use from Windows System restore:
- Never interrupt a system restore in progress (this includes attempting a system restore while your device is running on battery — it may go flat)
- Consider adjusting the system restore frequency or scheduling additional System Restores if you regularly tinker with new software and device drivers
- If you are trying to remove a recent update, consider using the Uninstall Updates feature of the Windows Recovery environment instead
- While System Restore should not touch the files in your user profile, you should keep separate backups of your important files so that they can be restored if your device is rendered completely unusable, or they are unexpectedly affected
Backing up and restoring Windows devices remotely and at scale
Deciding how to undo a system restore to reverse changes made by updates, drivers, or applications will depend on whether you are able to successfully boot your PC or not, and may require the use of Windows RE or Safe Mode. While System Restore is an effective tool for getting Windows 10 and 11 devices back up and running, it does not scale effectively, and does not restore user files that may have been lost or damaged in a malware attack.
For the best reliability in mission-critical enterprise environments, NinjaOne Backup provides a complete solution for protecting your devices and critical data, which covers all of your Windows and macOS workstations and mobile devices, as well as your servers. Rather than relying on Windows System Protection and manual intervention, you can automate the backup of full system images, as well as user files and directories.
