Windows 11 adds point-in-time restore: 72-hour rollback when updates bork PCs

Windows 11’s new point-in-time restore is an escape hatch for PCs that get wrecked after updates, and it comes with a hard timer: each restore point sticks around for 72 hours. If you have ever watched an update turn “it was fine yesterday” into “help, please,” this is the first new path that aims to fix the moment fast, by letting the device roll back to an earlier exact state.

According to Microsoft, point-in-time restore brings a Windows 11 PC back to its exact state at an earlier point in time, and it’s accessed through the Troubleshoot menu in the Windows Recovery Environment. Microsoft says each restore point covers the operating system, apps, settings, and local files, stored locally on the device. Restore points are automatically deleted after 72 hours or when free disk space falls below 20 GB, and new points are created approximately every 24 hours by default, though administrators can configure the interval.

Under the hood, this is not some mysterious brand-new mechanism. Like the existing System Restore functionality, point-in-time restore uses the Volume Shadow Copy Service (VSS) to get a device back to a previous state. The important distinction is scheduling and retention. Point-in-time restore is scheduled, while System Restore typically requires an event or manual intervention to trigger a restore point. In other words, Microsoft is trying to reduce the probability that users are stuck waiting for the “right” time or the “right” trigger.

Microsoft is also trying to solve the storage problem that always haunts rollback features. The company says point-in-time restore mitigates storage impact by using reserved storage, and it has a maximum retention period of 72 hours for each restore point. That combination, scheduled creation plus strict retention, suggests the design tradeoff is deliberate: the feature should be available when needed, but not so expensive on disk that it quietly becomes a new operational headache.

Availability is where the story gets more operational. Point-in-time restore is on by default on devices with an OS volume size of 200 GB or greater and not under enterprise management, which effectively covers Windows Home and Pro scenarios that are not centrally managed. It will be off by default on managed systems until Windows 11 26H2 arrives. There is also a pragmatic limitation: a restore can only be triggered locally. Microsoft says it plans to add remote initiation via Intune in the future, which matters for administrators who cannot (and should not) rely on a user to walk through a recovery workflow during an outage.

This is where boards and IT leaders should pay attention to second-order implications. In enterprise environments, incident response is not just “how do we fix it,” it’s “how do we fix it without amplifying downtime.” If point-in-time restore cannot be initiated remotely right away, then update-related failures that require a rollback will still put pressure on local support desks, on-site labor, or end-user cooperation. Microsoft notes that it has limited utility for administrators for that reason. Even so, the capability is not theoretical: it has been in public preview for some time and is enabled on more than two million devices.

There are also real workflow risks that administrators will want to plan for. Microsoft flags that Outlook can have problems after a restore, specifically a potential.ost data file mismatch. That may require deletion or renaming of files. Windows Recall may be disabled after a restore as well, and Microsoft frames “some might argue the latter is more of a feature than a known issue.” In plain English: this is a recovery lever, but it is not guaranteed to be frictionless for every productivity setup, especially for users who rely on specific email synchronization and memory-related experiences.

Microsoft is positioning point-in-time restore as part of a broader resiliency effort. The company describes it as an “important foundation for the future of Windows recovery,” labeling it part of the Windows resiliency initiative. And it is not hard to see why: if Windows updates can leave users needing recovery in the first place, then the recovery story becomes part of trust. Microsoft ends up with a dual task, make rollbacks faster for consumers, and make rollback governance workable for organizations.

The strategic stake for executives is the operational liability of update risk. Faster recovery reduces the visible blast radius of failed deployments and potentially lowers support burden, but the feature’s current shape emphasizes local intervention and tightly controlled retention. As Windows 11 26H2 expands managed availability, leadership teams should treat this as a policy question, not just a feature toggle. The teams that plan now will be better positioned to prevent “update went bad” moments from turning into churn, reputational damage, and expensive downtime. And for Microsoft’s enterprise customers, it’s a reminder that resiliency features only help if they fit the incident playbook, not just the user experience.