May 18, 2010

First things first, make sure that you've been making Restore Points all along by having System Protection on.

For some reason, we still don’t know why, some Windows 7 installations are deleting Windows 7 Restore Points. Here’s what we know and what you can do about it.

One of the few original contributions to operating systems that Microsoft can claim is its Restore Points feature. First included with Windows XP and the now-forgotten Windows ME, Windows automatically creates copies of system and application files, at stated intervals or before changes are made. If a new program installation or other “learning experience” wrecked the user’s system, these backed-up file collection and system settings, called Restore Points, could be used to restore a PC to a working state. What makes Restore Points different from a mere automatic back-up system is that it doesn’t touch documents and other user work files. To say, “This was much appreciated” is an understatement, especially when it’s your work that was saved.

Restore Points — and System Restore, the program behind them — worked well… until it didn’t. It turns out that many users are having serious trouble with Restore Points in Windows 7 . Whether the Restore Points are made manually, automatically by the system timer, or invoked by installing new software, they may vanish after any system reboot like morning dew on a sunny day.

The Easy Fix

If you’re lucky, it may just be that you don’t have System Restore set up correctly. To check on that status, see if Volume Shadow Copy (VSS) and Windows Backup Services are running and set to automatic in Services Console.

To do this, take the following steps.

  • Click on Start, type Services in Start Search. When the Services page is open, scroll the page to find Volume Shadow Copy and Backup Service.
  • Right click on them and check if they are started.
  • If the services are disabled, click to start the services and set them to Automatic.

By default, both services should already be on and set to Automatic for your primary partition, but I’ve seen incidents where they haven’t been. I suspect, but haven’t been able to prove, that the services have been turned off by malware. You should also keep in mind that VSS won’t work on FAT32 formatted partitions.

First things first, make sure that you've been making Restore Points all along by having System Protection on.

First things first, make sure that you've been making Restore Points all along by having System Protection on.

Once you’ve done that, force the system to make a Restore Point. To do that, do the following:

  • Open the Start Menu, Right click on the Computer button, and click on System Properties.
  • Click on the System Protection link. At this point, the Protection Settings should be on. If they’re not, re-check your services as I described above.
  • Click on Create.
  • After the Restore Point has been created, reboot your system.
  • Head back to System Protection, and click System Restore.
  • Click Next at the information window and you should see a display of available System Restore Points with your manually created Restore Point at the top.
This is what you should see if your Restore Points are both being made and not being automatically deleted.

This is what you should see if your Restore Points are both being made and not being automatically deleted.

If that all works well, congratulations. You really didn’t have a problem. But what if you discover that there’s not a Restore Point to be seen? Then you have trouble.

The Not-So-Easy Solution

At this point, take a closer look at the problem using System Viewer. To do so, click the Start button, click Control Panel, choose System and Maintenance, choose Administrative Tools. Then double-click on Event Viewer. You need to login with your administrator password to do this.

While there are several potential problems, the most common symptoms seems to be the following Volume Shadow Copy errors: Event IDs 22 and/or 8193. Event 22 is “Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and Name IVssCoordinatorEx2 is [0x80040154, Class not registered].” And Error 8193 is “Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0×80040154, Class not registered.”

Either way, it’s pretty cryptic, but we can leave that to Microsoft’s engineers. What we’re concerned with is getting System Protection back into gear.

The “easy” way to fix this is:

  1. Open an Elevated Command Prompt
  2. Change the VSS allocation by using the Vssadmin command. For example, with the C drive partition you’d enter vssadmin resize shadowstorage /On=C: /For=C: /Maxsize=20G. Maxsize is how much disk space you want to allocate to System Restore points. I typically use 5% of a partition, which I’ve found to be quite ample.
  3. Repeat the steps for manually creating a Restore Point.

Reboot, and check again to see if you now have a Restore Point. If you do, your problems are over. (Well, your Windows 7 Restore Point problems anyway. We can’t do anything about the CFO cutting back IT funding.)

Alas, if you don’t get joy from that process, things get more complicated.

Microsoft recommends you do this for an Event 22:

  1. Look for Event ID 22, and use the event text to identify the name of the application or service that caused the error condition.
    • If the event was caused by the COM+ event system, see the “Check that the COM+ Event System service is started” section.
    • If the event was not caused by the COM+ event system, see the “Use System Restore to create a manual restore point” section if your computer is running Windows 7.
  2. Check that the COM+ Event System service is started. To do so:
    • Click Start, click Administrative Tools, and then click Services.
    • In the results pane, double-click COM+ Event System.
    • In Service status, make sure that the status is Started. If the status is not Started, click Start.
    • Ensure that Startup type is set to Automatic.
    • Click OK.
  3. For an Event ID 8193 (Why can’t Microsoft just say error, rather than event?):
    • Go to Start\Run and type devmgmt.msc
    • Click on View and choose to Show Hidden Devices.
    • Now click the plus (+) next to Non-Plug and Play Drivers.

    Do you now see an items listed as DGIVecp? If not, we have to see what this is associated with by going to the registry.

    Needless to say, you should create a backup of the registry before you edit it, since you’re going to doing the Windows’ equivalent of brain surgery. To do that, you should create a Restore Point… oh wait, that’s the root problem isn’t it!?

    Instead, open the Start menu and type regedit in the search line. Once you have regedit up, click on File on the menu bar, then click on Export. Select where you want to save the exported .reg file, choose the All option under Export range, give the .reg file a name, and click on the Save button.

    With that done, take these steps in regedit:

    • Navigate to the following key: L HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    • Look for an entry listed as DgiVecp.
    • If you find this, then change the Start data value to 4.
    • Reboot the system and see if the message is gone.
    • If it is, once more create a manual Restore Point, and see if it survives a reboot.

    What If It Still Doesn’t Work?

    Now, let’s be pessimistic, and presume it still fails. Okay, step away from the computer, get a cup of coffee, take a walk, scream a little bit if you think that will help, and let’s try something else.

    Your problem may hide within an improperly set-up paging file.

    Your problem may hide within an improperly set-up paging file.

    One suggestion that has worked for some people is to check out your system for other problems. If you’re a PC tech, you know the drill: Scan for viruses, run chkdsk /r on all the volumes; run System File Checker) in scannow mode, make sure you have lots of free disk space; and disable disk defragmentation in case the disk defragger is destroying the shadow files. (Also see the several troubleshooting articles we have here at IT Expert Voice, such as Rescue Windows 7 in Five Minutes or Less.)

    Once that’s done, and you’ve killed off any viruses or repaired your hard drive, try again to create a manual Restore Point.

    Still having trouble? Okay, here’s one last thing you can try. Your paging file, pagefile.sys, might have the wrong Access Control List (ACL) settings. In this case, you’re probably also seeing long boot-up times with a lot of hard disk activity. If that sounds familiar, try this:

    1. Open the Start Menu, right click on the Computer button and click on System Properties.
    2. Click on Advanced and then click on Setting.
    3. This brings you to the Performance Options display. Here, click on Advanced, then Change.
    4. At the new display, uncheck the Automatically Manage Paging Files for all drives. Click and set the option for No paging file.
    5. OK your way back out to the main desktop and reboot.
    6. Once rebooted, try to make a Restore Point again and see if it will survive a reboot.

    Hopefully, one of these approaches works. If not, well, you won’t be the only one. In that case, the only “solution” is to rely upon conventional back-ups until Microsoft gets to the bottom of why System Protection fails on some systems. May that day come quickly!

    Want more like this? Sign up for the weekly IT Expert Voice newsletter so you don’t miss a thing!

Want more like this? Sign up for the weekly IT Expert Voice Newsletter so you don't miss a thing!


  • [...] This post was mentioned on Twitter by Esther Schindler, sjvn and MigrationExpertZone, IT Expert Voice. IT Expert Voice said: What To Do About Missing Windows 7 Restore Points by @sjvn [...]

  • eh… GoBack was the first that I remember MS just implemented it differently. E.G OS only not users docs.

  • Jun 15, 2010 | Farhad says:

    Refer the first Snap Shot… Click Configure and increase the disc space to 40 %. This sorted out my problem

  • Jul 13, 2010 | deskdata says:

    For the record on my system it was caused by the hibernation file. I fixed it by disabling and then enabling hibernation. I was getting none of the above errors and hibernation was working fine – just restore points not surviving a restart.
    This was on a new installation of W7 Professional x64.
    All is working fine now. Note that I've only allocated the default 12% to System Restore, on my 22Gb C: drive, i.e. just over 2GB, so there should be no need to allocate huge amounts of space to SR

  • Aug 23, 2010 | marianacnt says:

    I have a Dell Latitude e4300 with windows 7 and a few days ago i noticed all the restore points manually or automatically created disappeared when i reboot the machine. I think I already tried all of those things listed but none has worked. I realized that the item called DgiVecp which should be in the registry list is not. Would this be the cause? If so, how to put it back?
    Thank u in advance!

FM IT Expert Voice is a partnership between Dell and Federated Media. Privacy Statement