How To Use the System Restore Utility with Windows Management Instrumentation in Windows XP

Support for Windows XP has ended

Microsoft ended support for Windows XP on April 8, 2014. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article was previously published under Q295299
This article has been archived. It is offered "as is" and will no longer be updated.
This article describes how you can use the System Restore utility to create, enumerate, and restore previously created restore points by using Windows Management Instrumentation (WMI).

back to the top


To run WMI, you must have administrator privileges. You can use System Restore by means of WMI and the Srclient.dll file.

The following VBScript code excerpts are minimal examples. This code must not be implemented without prior error checking and full testing.

back to the top

To Create a System Restore Point

'use WMI moniker and SystemRestore classset SRP = getobject("winmgmts:\\.\root\default:Systemrestore")CSRP = SRP.createrestorepoint ("this is a test", 0, 100)				

back to the top

To Disable or Enable System Restore for a Particular Drive

onoff = inputbox ("Do you want enable or disable System Restore?", "System Restore")Drive = inputbox ("Which Drive would you like to take action on? Must type in format 'c:\'", "Drive to enable/disable")set SRP = GetObject("winmgmts:\\.\root\default:SystemRestore")If onoff = "enable"  theneSRP = SRP.enable(drive)end ifIf onoff = "disable" theneSRP = SRP.disable(drive)end if				

back to the top

To Enumerate System Restore Points on a Computer

set SRP = getobject("winmgmts:\\.\root\default").InstancesOf ("systemrestore")for each Point in SRPmsgbox point.creationtime & vbcrlf & point.description & vbcrlf & "Sequence Number= " & point.sequencenumbernext				
The dates are returned in yyyymmddHHMMSS.mmmmmmsUUU format, where:
yyyy= a four digit year
mm= a two digit month
dd= a two digit day of the month
HH= a two digit hour of the day (00-23)
SS= seconds (00-59)
mmmmmm= microseconds
s= plus (+) or minus (-) sign to signify the positive or negative offset from coordinated universal time (UTC)
UUU= an offset in minutes that the originating time zone deviates from UTC
NOTE: You cannot filter items based on specific dates. The filter process begins at the first restore points and enumerates from that location. If you want to filter items, you need to script a filter to narrow down the dates that are based on the values that are returned.

back to the top

To Roll Back to a Specific Restore Point

NOTE: Do not use this function without also calling a computer shutdown. System Restore may not work properly if a restart of the computer is not initiated immediately.
set SRP = getobject("winmgmts:\\.\root\Default:SystemRestore") eSRP = SRP.Restore(22) 'parameter passed is the sequence number of the restore point you want to roll back to.				

back to the top


Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements. back to the top
WMI system restore command line remote

Article ID: 295299 - Last Review: 12/06/2015 01:55:32 - Revision: 2.2

Microsoft Windows XP Professional, Microsoft Windows XP Home Edition

  • kbnosurvey kbarchive kbhowto kbhowtomaster KB295299