Windows 11 Has a New Restore Option — and Unlike System Restore, It Rolls Your Files Back Too

For about twenty-five years, one piece of Windows advice has been safe to give over the phone: if the machine started misbehaving a few days ago, run System Restore. It rolls back drivers, updates and settings, and — this was the part that made it safe to recommend — it does not touch your documents, photos or downloads. Worst case, it does nothing and you have lost twenty minutes.

That advice now needs a footnote, because Windows 11 has grown a second rollback feature that sits in the same menu, uses the same underlying machinery, is described with almost the same words, and behaves differently in exactly the way that matters. It is called point-in-time restore. Microsoft made it generally available on June 23, 2026, it is on by default on most home PCs, and its own documentation says plainly that a restore "includes user files, applications, settings, passwords, certificates, and keys."

So the two options now on offer are not the same option with a different name. One of them is the old, conservative rollback that leaves your files alone. The other rewinds the whole drive, your files included, and anything you created since the snapshot goes with it. This article is about telling them apart before you are sitting in front of a broken computer at eleven at night choosing between them.

What point-in-time restore actually is

In Microsoft's own description, "point-in-time restore enables users to restore a Windows PC to the exact state in which it was at an earlier point in time." The mechanism is the one Windows has used for snapshots for years — the Volume Shadow Copy Service, or VSS — but the policy around it is new.

Windows takes a snapshot on a schedule rather than when something happens. The default is approximately every 24 hours, running quietly in the background, and the snapshot is stored on the same disk it is protecting. Microsoft is explicit about how wide the net is: restore points "are comprehensive and include the OS, apps, settings, and local files (no user data is scoped out of the restore point)." That parenthesis is the whole story in eight words. Nothing of yours is excluded.

The snapshots are then thrown away aggressively. They are "kept for up to 72 hours," after which Windows deletes them automatically, oldest first. They also get deleted early under several other conditions, and the disk-space ones are worth knowing because they are common on a home laptop: when the space set aside for restore points is exceeded, and when "free disk space reaches or drops below 20 GB." There is also a catch-all case where, if the snapshot service hits a problem it cannot work around, "all restore points are removed."

Put those two properties together and you have the honest shape of the feature: a deep but very short rewind. Three days, everything on the system drive, gone the moment it ages out or the disk gets tight.

The difference that can cost you files

Microsoft publishes a side-by-side comparison of the two features, and the first row is the one to read twice. For point-in-time restore, what gets restored is the "Entire system: OS, apps, settings, and files." For System Restore, it is "System files and settings only; personal files are not affected."

The IT-facing announcement puts the same contrast in the language of the snapshot itself: with point-in-time restore, user files are included in the restore point; with System Restore, they are excluded from it. It is not a difference in what the restore chooses to overwrite. It is a difference in what was captured in the first place.

Now think about what that means in practice on a Wednesday. Your PC has been unstable since a driver update on Monday. You go into recovery and roll back to Monday morning. With System Restore, the driver goes back and the spreadsheet you built on Tuesday is still there. With point-in-time restore, the driver goes back and Tuesday is gone — the spreadsheet, the photos you imported off the camera, the thirty invoices you scanned, the password you changed, the software you installed. Microsoft says it directly: "Any changes you made after that restore point will be lost. This includes new files, app installations, settings changes, and passwords."

That is not a bug and it is not a criticism of the feature. Rewinding everything is precisely the point — it is what makes it able to undo damage System Restore cannot. But it does mean the safe old habit of "just run a restore, it cannot hurt" is no longer true for the option Windows now lists first.

One genuine consolation, and it is worth planning around: a restore "doesn't affect files stored in cloud services like OneDrive." Files that live in a synced folder and have actually finished syncing are held somewhere the rollback cannot reach. Files sitting on the desktop of a PC with no cloud sync are not.

It is probably already switched on, and nobody told you

This is the part most people are surprised by. Point-in-time restore is not something you opt into. Microsoft turns it on by default on Windows Home edition devices, and on Windows Pro devices that are not domain joined and not enrolled in enterprise endpoint management — which is to say, essentially every PC in a house and most PCs in a small business that does not run a managed IT setup.

The inversion is worth noting because it is the opposite of what you would guess: it is business machines under central management where the feature currently ships switched off, and Microsoft says that flips to on by default starting with Windows 11, version 26H2.

There is one hardware condition attached. Microsoft: "Only devices with an OS volume size of 200 GB or greater will have the feature On by default." If your laptop has a 128 GB drive — still common on cheaper machines and on a lot of older ones — it will be off, and you can turn it on manually if you want it, though on a drive that small you should think hard about the space first.

The other condition is which Windows you are running. Point-in-time restore is generally available "on Windows 11 Client PCs on versions 24H2 and later," across the Home, Pro and Enterprise editions. If you are on Windows 10, this is not a feature you have, and with Windows 10 support ending it is not one to wait for. You can check your version in Settings, under System and then About.

Where to find it, and what you are allowed to change

To see whether it is running on your machine, open Settings, go to System, then Recovery, and select Point-in-time restore. Select View or edit, and approve the User Account Control prompt. You need to be a local administrator on the PC to look at this at all.

Inside, you will see the on/off toggle, the current settings, how much disk space the restore points are using right now, and a list of the restore points that exist with their timestamps. That list is the genuinely useful bit: it tells you, in advance and at leisure, exactly how far back you could go if you had to.

What you can change is narrower than it looks. On a home or ordinary business PC, the two things in your control are whether the feature is on, and the maximum amount of disk space it is allowed to use — which defaults to 2% of the drive, with a floor of 2 GB and a ceiling equivalent to 50 GB. The frequency and the retention period are shown, but Microsoft restricts changing those to the Enterprise edition. You cannot tell a Home PC to keep a week instead of three days.

Switching the feature off does not immediately reclaim the space, either. Existing restore points stay until they expire normally or until Windows needs the room.

How you actually run a restore — and why that matters

You cannot start a point-in-time restore from inside Windows. The only way in is the Windows Recovery Environment, the blue-grey troubleshooting screen that appears after repeated boot failures or when you choose Advanced startup from Settings. Once there, the path is Troubleshoot, then Point-in-time restore.

From there Windows asks for your BitLocker recovery key if the drive is encrypted, shows you the available restore points to choose from, makes you confirm that you understand the risk, and then runs. When it finishes, the machine restarts into Windows as it was.

Two warnings from Microsoft are worth repeating word for word, because people ignore them and then need a repair shop. "Do not power off your device during a restore. This could leave your PC in an unusable state." And: "We recommend plugging in your device to power before starting." A laptop that dies on battery halfway through a full-system rollback is a much worse problem than the one you were trying to fix.

One more consequence to plan for afterwards: "A restore process might revert recent security updates." Rewinding three days can take a patch with it. Check for updates once the machine is back up, rather than assuming it is current because it was current yesterday.

Two things that will stop you cold, and both are avoidable today

Because recovery is the only route in, everything that stands between you and the recovery screen also stands between you and this feature. Two of those come up constantly in our workshop, and both are fixable now, while the computer still works — which is the only time they are easy.

The first is the BitLocker recovery key. Windows 11 encrypts a lot of machines automatically these days, including ones whose owners have never heard the word BitLocker, and the recovery screen will ask for that key before it will restore anything. If it is not saved somewhere you can reach from another device, the restore simply does not happen. Go and find your key now, and make sure it is somewhere that is not on the encrypted computer.

The second is more mundane and catches people out badly: your keyboard and mouse have to work on the recovery screen, and that is not the same thing as working in Windows. The recovery environment is a separate miniature operating system with its own driver set, and it is entirely possible for a keyboard that types fine in Windows to do nothing at all in there. A restore you cannot navigate to is not a restore.

There are a few smaller blockers documented as well, and they are worth knowing if the option is greyed out or fails. A restore point taken before you changed Windows edition will not work afterwards — Microsoft: "It's not possible to use a restore point taken under a different Windows edition/SKU than the one currently installed," so a Home-to-Pro upgrade discards what came before. Encrypted File System files are a hard stop: "Usage of EFS encrypted files prevents system restoration." Only the Windows drive is rolled back — "Other drives are not affected" — so a second internal disk or an external drive is untouched, for better and for worse. And the restore needs room to work: you need at least as much free space as all your restore points take up combined.

Seventy-two hours is not a backup, and it is not trying to be

It would be easy to read all this and conclude the PC is now backing itself up. It is not, and the two facts that settle it are ones Microsoft states rather than hides.

The snapshots live on the same physical disk as the thing they protect. If that drive fails — and drives fail — the restore points fail with it. A backup that dies with the original is not a backup; it is a convenience. The same goes for theft, for a flooded garage, and for ransomware that encrypts everything it can reach.

And the window is three days. Not three days of file history you can pick individual documents out of — three days of whole-system snapshots, all-or-nothing, and then they are deleted. You cannot use point-in-time restore to get back the file you deleted last month, or last week, or in some cases yesterday afternoon if the disk got tight overnight. It also cannot pull one file out of a snapshot: the documentation is explicit that exporting or mounting a restore point as a separate image is not supported. It is the whole machine or nothing.

What it is genuinely good at is the narrow thing it was built for: something changed in the last day or two — an update, a driver, an install, a settings change — and the machine has been wrong ever since. For that, it is faster and more thorough than anything else built into Windows. For everything else, you still need a real backup: a copy on a separate device or in the cloud, ideally both, ideally automatic.

What it does to your disk space

The default budget is 2% of the drive, and Microsoft has designed the storage impact to be less than it sounds. The space is not carved out and locked away in advance — it is a ceiling, not a reservation, and unused capacity stays available to the system. Some of it also comes out of reserved storage, the slice Windows already sets aside so updates have somewhere to land.

But there are two practical effects worth knowing if you are the sort of person who fights with a full C drive. The first is that on a machine that is already nearly full, the feature will quietly eat itself: once free space hits 20 GB, Windows starts deleting restore points to stay out of the way. You may believe you have three days of rollback and have almost none.

The second is that this and System Restore share one pot. Microsoft: "VSS storage shares space with multiple tools that use VSS (for example, System Restore or non-Microsoft rollback software). Point-in-time restore can't reserve a siloed pool." If you also run third-party rollback or backup software that uses shadow copies, all of it is competing for the same allowance, and they can evict each other's snapshots. Microsoft's own advice is to avoid combining point-in-time restore with other VSS-based tools where you can.

What we would actually tell you to do

Leave it switched on, unless your drive is small or nearly full. It costs a couple of percent of a disk you are probably not using all of, and the day it saves you a full reinstall it will have paid for itself many times over. If you are already fighting for space, that is a reason to deal with the space problem rather than to turn off your recovery options.

Go and look at the settings page once, today, while nothing is wrong. Confirm whether it is on, see how far back the restore points go, and note it. Five minutes now removes all the guesswork from a bad evening later.

Find your BitLocker recovery key and put it somewhere that is not the computer. This is the single highest-value thing on this list, and it matters well beyond this one feature.

When the moment comes and you are choosing in the recovery menu, ask one question: have I created anything on this machine in the last day or two that exists nowhere else? If the answer is no — and it often is, if your documents live in OneDrive and the problem is a bad driver — take point-in-time restore, because it is more thorough. If the answer is yes, or you are not sure, that is what System Restore is still for. Microsoft says the same thing, from the other direction: "If point-in-time restore is not available or you need to go back further than 72 hours, use System Restore."

And if the answer is yes and the machine will not boot at all, stop before you restore anything. Files that exist in one place on a computer you cannot start are worth ten minutes of a professional's time and not worth a guess. A rollback is not reversible.

When to bring it to us

We are a local computer repair shop in Southern California, and this is routine work for us. If you are staring at a recovery screen and cannot tell which option is safe, if the restore fails or the machine will not come back up afterwards, if BitLocker is asking for a key nobody has, or if there are files on the drive you genuinely cannot lose, call before you experiment. Getting data off a machine is usually straightforward while it is still intact and much harder after a failed rollback.

And if the honest answer is that nothing on that computer is backed up anywhere else, let us fix that part too. Three days of local snapshots is a good safety net for a bad update. It is not a plan for a dead drive.