XP Pro System Recovery not working

[John Nasta]

I have a Dell C610 laptop w/ P 1GHz, 1GB RAM, 100GB HD and XP Professional.
System Recovery tells me that I have no recovery points set. If I try to
create a recovery point, it says that my recovery point was created
sucessfuly, but then when I go back to the main page or try to run a restore
operation, it still says that I have no recovery points set. If I click
"System Restore Settings" it takes me to what are actually Windows Automatic
Update settings. There are 6 tabs there, and none of them say anything about
System Restore. It seems to me that I should be able to schedule System
Restore to remind me to create a restore point every so often, and I also
don't understand why I can't manually create a restore point. Any help is
appreciated.

Thank you,
JN

 

[Bert Kinney]

Hi John,

Here's a new page i created that covers missing restore points in System
Restore.
Disappearing Restore Points:
http://bertk.mvps.org/html/missingrps.html

By default System Restore automaticly crearts a restore point every 24
hours. It looks like in this case restore points are being created, but
being deleted just as fast.

Description of System Restore:
http://bertk.mvps.org/html/description.html

 

[John Nasta]

Thanks Bert,

Just FYI, I ran disk cleanup and told it to delete all but the most recent
restore point, and then suddenly the restore point that I created showed up
in System Restore. Maybe that will help someone else. As far as System
Restore making automatic restore points, I guess I'll just have to check it
and see if it does that.

Great info on your web pages. I only had time to scan them quickly just now,
but it doesn;t look as though you have mentioned srdiags.exe and the log
files that it creates. In my case, reading the log files didn't help.

There is also info here:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q301224

JN

 

[Bert Kinney]

Hi John,

You will also want to take a look at this page also.

System Restore fails to create an automatic restore point:
http://bertk.mvps.org/html/srauto.html

Srdiag is mentioned here.
http://bertk.mvps.org/html/tips.html#SRDiag

Can you post any sr or srservice logs from the Event Viewer?

 

[John Nasta]

A couple of things pointed out here...

This is a refurbished Dell C610 that I bought about a week ago.

The CMOS date and time were wrong when I got this computer. There is a SR
error event that accured on 3/8/06 (a date that hasn't happened yet). That
is actually the oldest one, and it happened before I ever tried to run
System Restore.

I also changed the HD from a 20GB to a 100GB, but even on the 20GB there was
only about 2GB of data (Windows XP installed and nothing else). So, there
never was a shortage of HD space regardless of what the error logs say.

srdiag.exe created these 6 files on 2/11/06 at 7:08pm:

machineguid.txt
{ D A 0 E E A D 6 - E 0 0 A - 4 A D D - A A 3 6 - 3 6 E 8 1 7 0 C 8 3 6 D }

SR-ChgLog.LOG
{ D A 0 E E A D 6 - E 0 0 A - 4 A D D - A A 3 6 - 3 6 E 8 1 7 0 C 8 3 6 D }

SR-FileList.LOG
C:\WINDOWS\system32\drivers\sr.sys
Creation Date=Wednesday March 8, 2006 11:57:55
Last Access Date=Thursday Feburary 9, 2006 5:5:40
Last Write Date=Wednesday August 4, 2004 6:6:25
Attributes=ARCHIVE
VolumeSerialNumber=945698080
FileSize=073472
NumberOfLinks=1
Language=4094b0
CompanyName=Microsoft Corporation
FileDescription=System Restore Filesystem Filter Driver
FileVersion=5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName=sr.sys
LegalCopyright=© Microsoft Corporation. All rights reserved.
OriginalFilename=sr.sys
ProductName=Microsoft® Windows® Operating System
ProductVersion=5.1.2600.2180

C:\WINDOWS\system32\srclient.dll
Creation Date=Wednesday March 8, 2006 12:2:57
Last Access Date=Saturday Feburary 11, 2006 23:13:29
Last Write Date=Wednesday August 4, 2004 7:56:45
Attributes=ARCHIVE
VolumeSerialNumber=945698080
FileSize=067584
NumberOfLinks=1
Language=4094b0
CompanyName=Microsoft Corporation
FileDescription=SR CLIENT DLL
FileVersion=5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName=SRCLIENT.DLL
LegalCopyright=© Microsoft Corporation. All rights reserved.
OriginalFilename=SRCLIENT.DLL
ProductName=Microsoft® Windows® Operating System
ProductVersion=5.1.2600.2180

C:\WINDOWS\system32\srsvc.dll
Creation Date=Wednesday March 8, 2006 12:2:58
Last Access Date=Sunday Feburary 12, 2006 0:4:5
Last Write Date=Wednesday August 4, 2004 7:56:45
Attributes=ARCHIVE
VolumeSerialNumber=945698080
FileSize=0170496
NumberOfLinks=1
Language=4094b0
CompanyName=Microsoft Corporation
FileDescription=System Restore Service
FileVersion=5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName=SERVICE.DLL
LegalCopyright=© Microsoft Corporation. All rights reserved.
OriginalFilename=SERVICE.DLL
ProductName=Microsoft® Windows® Operating System
ProductVersion=5.1.2600.2180

C:\WINDOWS\system32\srrstr.dll
Creation Date=Wednesday March 8, 2006 12:2:57
Last Access Date=Saturday Feburary 11, 2006 23:13:29
Last Write Date=Wednesday August 4, 2004 7:56:45
Attributes=ARCHIVE
VolumeSerialNumber=945698080
FileSize=0239104
NumberOfLinks=1
Language=4094b0
CompanyName=Microsoft Corporation
FileDescription=System Restore Restore Operation Library
FileVersion=5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName=srrstr
LegalCopyright=© Microsoft Corporation. All rights reserved.
OriginalFilename=srrstr.dll
ProductName=Microsoft® Windows® Operating System
ProductVersion=5.1.2600.2180

C:\WINDOWS\system32\restore\filelist.xml
Creation Date=Wednesday March 8, 2006 12:2:14
Last Access Date=Saturday Feburary 11, 2006 23:14:8
Last Write Date=Saturday July 17, 2004 18:40:21
Attributes=HIDDEN READONLY SYSTEM
VolumeSerialNumber=945698080
FileSize=019528
NumberOfLinks=1

C:\WINDOWS\system32\restore\rstrui.exe
Creation Date=Wednesday March 8, 2006 12:2:14
Last Access Date=Sunday Feburary 12, 2006 0:3:59
Last Write Date=Wednesday August 4, 2004 7:56:55
Attributes=ARCHIVE
VolumeSerialNumber=945698080
FileSize=0380416
NumberOfLinks=1
Language=4094b0
CompanyName=Microsoft Corporation
FileDescription=System Restore Application
FileVersion=5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName=RSTRUI.EXE
LegalCopyright=© Microsoft Corporation. All rights reserved.
OriginalFilename=RSTRUI.EXE
ProductName=Microsoft® Windows® Operating System
ProductVersion=5.1.2600.2180

C:\WINDOWS\system32\restore\srframe.mmf
Creation Date=Wednesday March 8, 2006 12:2:15
Last Access Date=Saturday Feburary 11, 2006 23:13:29
Last Write Date=Wednesday July 16, 2003 16:40:37
Attributes=ARCHIVE
VolumeSerialNumber=945698080
FileSize=0984
NumberOfLinks=1

C:\WINDOWS\system32\restore\sr.mof

SR-Reg.txt

[Software\Microsoft\Windows NT\CurrentVersion]
"SubVersionNumber"=REG_SZ:
"CurrentBuild"=REG_SZ:1.511.1 () (Obsolete data - do not use)
"InstallDate"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1125534762
"ProductName"=REG_SZ:Microsoft Windows XP
"RegDone"=REG_SZ:
"RegisteredOrganization"=REG_SZ:
"RegisteredOwner"=REG_SZ:user
"SoftwareType"=REG_SZ:SYSTEM
"CurrentVersion"=REG_SZ:5.1
"CurrentBuildNumber"=REG_SZ:2600
"BuildLab"=REG_SZ:2600.xpsp_sp2_gdr.050301-1519
"CurrentType"=REG_SZ:Uniprocessor Free
"CSDVersion"=REG_SZ:Service Pack 2
"SystemRoot"=REG_SZ:C:\WINDOWS
"SourcePath"=REG_SZ:\I386
"PathName"=REG_SZ:C:\WINDOWS
"ProductId"=REG_SZ:55274-OEM-0011903-00102
"DigitalProductId"=REG_BINARY:¤
"LicenseInfo"=REG_BINARY:

[Software\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:0
"CreateFirstRunRp"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1
"DSMin"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:200
"DSMax"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:400
"RPSessionInterval"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:0
"RPGlobalInterval"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:86400
"RPLifeInterval"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:7776000
"CompressionBurst"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:60
"TimerInterval"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:120
"DiskPercent"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:12
"ThawInterval"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:900
"RestoreDiskSpaceError"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:0

[Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\Cfg]
"DiskPercent"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:12
"MachineGuid"=REG_SZ:{DA0EEAD6-E00A-4ADD-AA36-36E8170C836D}

[Software\Microsoft\Windows
NT\CurrentVersion\SystemRestore\SnapshotCallbacks]
""=REG_SZ:

[System\CurrentControlSet\Services\SR]
"Type"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:2
"Start"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:0
"ErrorControl"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1
"Tag"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:4
"ImagePath"=REG_EXPAND_SZ:System32\DRIVERS\sr.sys
"DisplayName"=REG_SZ:System Restore Filter Driver
"Group"=REG_SZ:FSFilter System Recovery

[System\CurrentControlSet\Services\SR\Parameters]
"FirstRun"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:0
"DontBackup"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:0
"MachineGuid"=REG_SZ:{DA0EEAD6-E00A-4ADD-AA36-36E8170C836D}

[System\CurrentControlSet\Services\SR\Security]
"Security"=REG_BINARY:


[System\CurrentControlSet\Services\SR\Enum]
"0"=REG_SZ:Root\LEGACY_SR\0000
"Count"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1
"NextInstance"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1

[System\CurrentControlSet\Services\SRService]
"Type"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:32
"Start"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:2
"ErrorControl"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1
"ImagePath"=REG_EXPAND_SZ:%SystemRoot%\System32\svchost.exe -k netsvcs
"DisplayName"=REG_SZ:System Restore Service
"DependOnService"=REG_MULTI_SZ:RpcSs
"DependOnGroup"=REG_MULTI_SZ:
"ObjectName"=REG_SZ:LocalSystem

[System\CurrentControlSet\Services\SRService\Parameters]
"ServiceDll"=REG_EXPAND_SZ:C:\WINDOWS\System32\srsvc.dll

[System\CurrentControlSet\Services\SRService\Security]
"Security"=REG_BINARY:


[System\CurrentControlSet\Services\SRService\Enum]
"0"=REG_SZ:Root\LEGACY_SRSERVICE\0000
"Count"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1
"NextInstance"=REG_DWORD or REG_DWORD_LITTLE_ENDIAN:1

[Software\Policies\Microsoft\Windows NT\SystemRestore]

SR-rp.LOG
Processing Mount Point [C:\]
No restore points for Mount Point [C:\]

SR-RstrLog.txt was empty


There are also 3 SR error and 5 SRservice information events.

SR Service:

2/11/06 9:12:36pm Information Event ID 108

The System Restore service has resumed monitoring due to space freed on the
system drive.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

2/11/06 9:09:58pm Information Event ID 107

The System Restore service has been suspended because there is not enough
disk space available on the drive
\\?\Volume{2bfc4d81-a40a-11d7-adf0-000bdba274f0}\. System Restore will
automatically resume service once at least 200 MB of free disk space is
available on the system drive.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

2/11/06 8:36:07pm Information Event ID 107

The System Restore service has been suspended because there is not enough
disk space available on the drive
\\?\Volume{2bfc4d81-a40a-11d7-adf0-000bdba274f0}\. System Restore will
automatically resume service once at least 200 MB of free disk space is
available on the system drive.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

2/11/06 8:36:07pm Information Event ID 107

The System Restore service has been suspended because there is not enough
disk space available on the drive
\\?\Volume{2bfc4d81-a40a-11d7-adf0-000bdba274f0}\. System Restore will
automatically resume service once at least 200 MB of free disk space is
available on the system drive.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



SR:

2/11/06 9:09:56pm Error Event ID 1

The System Restore filter encountered the unexpected error '0xC000007F'
while processing the file 'AdbeRdr707_en_US.exe' on the volume
'HarddiskVolume3'. It has stopped monitoring the volume.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

2/11/06 8:36:03pm Error Event ID 1

The System Restore filter encountered the unexpected error '0xC000007F'
while processing the file 'c610_sme.exe' on the volume 'HarddiskVolume2'.
It has stopped monitoring the volume.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

3/8/06 6:07:43pm Error Event ID 1

The System Restore filter encountered the unexpected error '0xC0000022'
while processing the file 'ntuser.ini' on the volume 'HarddiskVolume1'. It
has stopped monitoring the volume.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Bert Kinney]

A couple of things pointed out here...

This is a refurbished Dell C610 that I bought about a week ago.

The CMOS date and time were wrong when I got this computer. There is
a SR error event that accured on 3/8/06 (a date that hasn't happened
yet). That is actually the oldest one, and it happened before I ever
tried to run System Restore.

I also changed the HD from a 20GB to a 100GB, but even on the 20GB
there was only about 2GB of data (Windows XP installed and nothing
else). So, there never was a shortage of HD space regardless of what
the error logs say.

If any monitored drive/partition falls below 50mb's of free disk space,
all restore points will be deleted. So it's best to only let System
Restore monitor the partition Windows is installed on.

Do a search for the following files and make post there locations. In
Search - More advanced options, select the first three options before
searching.
AdbeRdr707_en_US.exe
c610_sme.exe
ntuser.ini

srdiag.exe created these 6 files on 2/11/06 at 7:08pm: