Proper Registry Settings For System Restore Utility

[Chris Sherlock]

For the past several days, my system restore utility has failed to work. I
currently have no restore points on my computer, although the events log
indicates that my computer has tried to create six restore points in the
past five days. I am also currently unable to manually create a restore
point. The error properties of the unsuccessful restore events in the seem
to indicate successfully creating a manual restore point would get my
computer to begin automatically creating system restore points again. I've
tried various solutions that I've come across online, including disabling
System Restore, restarting my computer and then enabling System Restore. I
have also tried reinstalling System Restore. So far, however, nothing I've
done has worked. I now believe there is a possibility a registry setting
controlling System Restore may have somehow gotten set to an incorrect value
on my computer.

On the basis of Microsoft Article ID #295659, it appears there are three
keys that can be used to modify System Restore, as follows:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Sr
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Srservice

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\SystemRestore

The article points out that the first two keys and the values associated
with them must not be modified under any circumstances, so I have been
reluctant to make any changes. However, I'd like to know what the settings
should be for the values in the keys named above so I can compare the
correct settings to those on my computer. Thanks for any help with this.

 

[Bert Kinney]

Hi Chris,

Go to Start - Run and type eventvwr.msc and press enter
Click the Source tab to sort by name, and then look for "sr" or
"srservice." Double-click each of these services, and then evaluate
the event description for any indication of the cause of the problem.
Post the Source and EventID of any errors.

Here are some troubleshooting steps to follow.
System Restore Failures to restore
http://home.earthlink.net/~mvp_bert/html/srfail.html

 

[Bill James]

One common cause of System Restore failing is insufficient disk space. Make sure there is enough free disk space on ALL drives that have System Restore enabled.

--

Bill James
Microsoft MVP - Shell/User

Windows VBScript Utilities » www.billsway.com/vbspage/
Windows Tweaks & Tips » www.billsway.com/notes_public/

 

[Chris Sherlock]

Hi Chris,

Go to Start - Run and type eventvwr.msc and press enter
Click the Source tab to sort by name, and then look for "sr" or
"srservice." Double-click each of these services, and then evaluate the
event description for any indication of the cause of the problem.
Post the Source and EventID of any errors.

Here are some troubleshooting steps to follow.
System Restore Failures to restore
http://home.earthlink.net/~mvp_bert/html/srfail.html

Bert,

Thanks for the response. Here are the results of the Event Viewer test you
asked me to run:

Source srservice--All contain information about when I enabled and disabled
System Restore in an effort to fix it by turning System Restore off,
restarting, and turning it back on. No errors associated with any of these
messages.

Soruce sr--All event ID's associated with this source have an ID of 1 and
cover a period of March 6-March 11, 2005. The error message associated with
all of the errors is the same and reads as follows:

"The System Restore filter encountered the unexpected error '0xC0000243'
while processing the file 'Savrt2' on the volume 'Harddisk2'. It has
stopped monitoring the volume.

My guess is that this refers to the recovery partition that came with my
computer. Apparently, all HP Pavillions come with this partition, which
allows you to make recovery CD's. I have already made these. The manual
that came with my computer says that the recovery partition can be deleted
to free up extra disc space after you create the recovery CD's.

The following may not be information that you need, but I figure too much
information is better than too little. In the events log, there are several
instances of errors associated with the source Service Control Manager
spanning the time frame March 6-March 11, 2005. Most of them have an event
ID of 7023 and the events with this ID have the following error message
associated with them:

"The Application Management Service terminated with the following error: The
specified module could not be found."

There are a number of other error messages associated with the source
Service Control Manager with different event ID's.
Finally, there are several errors associated with the source DCOM, most with
an event ID of 1005 and with an error message of "DCOM got the message,
'This service cannot be started in Safe Mode.'"

Regarding the web page you suggested I consult, I did a virus check and a
spyware check, as recommended there. No viruses found, but there was some
adware/spyware that I had to remove. I checked Task Scheduler and it is
apparently running, as is System Restore Service. There is enough free disk
space for System Restore to run, and the amount of disk space to use for
System Restore is set at twelve percent on all drives. Thanks for any
further help.

Chris

 

[Chris Sherlock]

One common cause of System Restore failing is insufficient disk space. Make
sure there is enough free disk space on ALL drives that have System Restore
enabled.

--

Bill James
Microsoft MVP - Shell/User

Windows VBScript Utilities » www.billsway.com/vbspage/
Windows Tweaks & Tips » www.billsway.com/notes_public/

Thanks, Bill. I checked on that, but the disk space level is okay on all
drives.

Chris

 

[Bert Kinney]

Hi Chris,

There's no need to have System Restore monitor any drives other than
C:\ at this point.
This is assuming Windows is installed on C:\

Disable all monitored drives and restart the system. Enable monitoring
on C:\ and set disk space used to just under 1gb. Now try restoring to
the restore point just created.

Report back with the results.

 

[chris_sherlock]

Hi Chris,

There's no need to have System Restore monitor any drives other than
C:\ at this point.
This is assuming Windows is installed on C:\

Disable all monitored drives and restart the system. Enable monitoring
on C:\ and set disk space used to just under 1gb. Now try restoring to
the restore point just created.

Report back with the results.

Bert, I tried your suggestion above. Unfortunately, System Restore
still isn't working.

Chris

 

[Bert Kinney]

Bert,

Thanks for the response. Here are the results of the
Event Viewer test you asked me to run:

Source srservice--All contain information about when I
enabled and disabled System Restore in an effort to fix
it by turning System Restore off, restarting, and turning
it back on. No errors associated with any of these
messages.
Soruce sr--All event ID's associated with this source
have an ID of 1 and cover a period of March 6-March 11,
2005. The error message associated with all of the
errors is the same and reads as follows:
"The System Restore filter encountered the unexpected
error '0xC0000243' while processing the file 'Savrt2' on
the volume 'Harddisk2'. It has stopped monitoring the volume.

This error indicates that HD2 is being monitored by System Restore.
Do not let SR monitor this drive.

My guess is that this refers to the recovery partition
that came with my computer. Apparently, all HP
Pavillions come with this partition, which allows you to
make recovery CD's. I have already made these. The
manual that came with my computer says that the recovery
partition can be deleted to free up extra disc space
after you create the recovery CD's.

If SR keep failing, I would suggest deleting this partition per the HP
instructions.
Test to see if SR functions correctly by creating a restore point and
restoring back to it.

 

[Bert Kinney]

Hi Chris,

Savrt is a Norton file. I would suggest uninstalling any Norton
products that contain that file then test System Restore.