Microsoft has quietly begun rolling out a new recovery feature in Windows 11 that can rewind your entire PC to a previous state—personal files and all. The feature, called point-in-time restore, arrived with the June 2026 non-security update and is enabled by default on millions of unmanaged consumer devices. It is a major step forward for system rescue, but misusing it can wipe out hours or days of unsaved work.
Exactly What Changed
Point-in-time restore takes the old System Restore concept and expands its reach dramatically. Rather than merely rolling back system files, drivers, and the registry, this new tool captures a full snapshot of your Windows system drive. That includes the operating system, desktop applications, settings, locally stored passwords, encryption certificates, and—critically—all user files saved on that drive.
Windows creates these snapshots automatically in the background using the Volume Shadow Copy Service (VSS), roughly once every 24 hours. The last three days’ worth of restore points are retained, giving you a rolling 72-hour window. The entire mechanism is local, works entirely within the Windows Recovery Environment (WinRE), and requires no internet or cloud connectivity to operate.
Storage consumption is capped at 2% of the system drive, with a minimum of 2 GB and a maximum of 50 GB. This space isn’t pre-allocated; it grows only when snapshots are taken and is released when the disk runs low, dropping below 20 GB of free space triggers automatic deletion of older restore points.
The feature is currently turned on by default for:
- Windows 11 Home devices
- Windows 11 Pro devices not joined to a domain or managed by enterprise endpoint management
- Devices where the system drive is 200 GB or larger
If your PC meets these criteria, point-in-time restore is probably already active. You can check under Settings > System > Recovery > Point-in-time restore.
What It Means for You
For everyday users, this is a double-edged sword. On one hand, recovering from a bad driver, a failed Windows update, or a broken software installation no longer demands a factory reset or days of reinstalling apps. A full system rollback can be completed in minutes from the recovery environment, and you don’t need a cloud connection to do it.
On the other hand, the very completeness of the rollback is its greatest danger. Restoring to a snapshot taken 48 hours earlier returns the entire C: drive to exactly what it looked like at that moment. Every document you created, every password you saved, every application you installed, and every configuration change you made since then will be gone. And unlike classic System Restore, this time there is no deliberate exclusion of your personal files.
If you store important work in the default Documents, Desktop, Pictures, or Downloads folders, those files are in the restore crosshairs. Even local browser profiles, VPN settings, and encrypted files can be rolled back. Cloud-synced files in OneDrive are not directly reverted on the server, but if they hadn’t finished syncing before the restore, you may lose recent edits. The timing of that last sync becomes critical.
Power users and developers face additional risks: virtual machine states, local code repositories, development tools, and locally stored databases can all be set back. For anyone who relies on the system drive for active projects, a mistaken rollback can be catastrophic.
IT professionals managing fleets will need to weigh the benefits of rapid device remediation against the risk of data loss on managed endpoints. While enterprises can adjust snapshot frequency and retention (from 4- to 24-hour intervals and custom retention periods) and can disable the feature entirely, many unmanaged Pro devices will have it enabled by default without administrative oversight. The potential for help-desk calls about vanished work is real.
BitLocker users must pay special attention: entering the recovery environment to perform a restore will likely require your BitLocker recovery key. If you don’t have it accessible, you could be locked out of your own machine at the worst possible moment.
How We Got Here
Windows recovery has long been a source of user frustration. Traditional System Restore often failed to fix the hardest problems, while Reset This PC meant reinstalling every application and reconfiguring settings from scratch. Major incidents, most notably the CrowdStrike update failure that disabled countless enterprise systems, underscored the need for a faster, more robust local recovery option.
Microsoft’s answer was to lean on VSS—a technology that has existed for decades—to create lightweight, frequent snapshots of the entire system volume. By integrating these snapshots directly into WinRE, the company built a recovery path that works even when Windows won’t boot. The 72-hour retention window is intentionally short; Microsoft is not positioning this as a backup tool, but as an emergency undo button for recent changes.
The rollout to consumer PCs began in June 2026, following months of Insider testing. It arrives alongside a broader push for Windows resilience, including tighter qualification of third-party drivers and kernel-level software. For home users, the feature is a welcome safety net. For professionals, it’s a powerful but potentially hazardous weapon that demands careful handling.
What to Do Now
1. Check your configuration
Open Settings > System > Recovery and look for Point-in-time restore. Verify whether it’s enabled and how much space it’s using. If you’re on a machine with a small SSD (under 200 GB), it likely isn’t active, but you can turn it on manually if you want the protection.
2. Understand when to use it
Point-in-time restore is intended for severe software failures: a botched driver, a corrupted update, or a misconfiguration that prevents normal startup. For more isolated problems, safer tools like System Restore (which doesn’t touch user files) or the built-in “Go back” option after a feature update might be more appropriate.
3. Always save work before touching recovery
If your PC still boots, copy all critical current work to an external drive, network location, or verified cloud folder before you initiate any restore. Check your OneDrive sync status—if you see pending uploads, let them finish first. A restore will revert the local disk, but you want the cloud versions to be the latest.
4. Verify the restore point timestamp
In the recovery environment, you’ll see a list of available snapshots with dates and times. Don’t click in a panic—read every detail. Note what you did after that time. A restore point from “yesterday at 3:00 PM” may be missing an entire day’s work if you’re not careful.
5. Secure your BitLocker recovery key
Before trouble strikes, make sure your BitLocker key is accessible—saved to your Microsoft account, printed, or stored in a password manager. If your system drive is encrypted, you will need it during the restore process.
6. Plan for post-restore updates
After a successful rollback, Windows will be in an older state. Immediately run Windows Update and check your security software. Some recent patches and driver updates will need to be reinstalled. On systems with Windows Recall, the feature may ask for fresh consent before resuming snapshot captures.
7. Treat point-in-time restore as a short-term safety net, not a backup
Its local nature means drive failure or theft can take your snapshots with it. Combine it with a real backup strategy: cloud sync for important documents, File History or a dedicated backup tool for longer-term recovery, and an offline copy for disaster protection. Only then can you use this new feature with confidence.
Outlook
Microsoft is expected to refine the feature based on telemetry and feedback. Enterprise controls may expand, particularly around secondary drives and encryption complexities. For consumers, the biggest priority is education: too many users still equate System Restore with a backup. A dialog box confirming “this will delete files created after the restore point” is only effective if people read it. As Windows 11 continues to mature, expect recovery options to become more integrated—but also more demanding of a user’s own data discipline.