Windows 10: Create System Restore Point shortcut in Windows 10

The Event Viewer shows "Event 8193"

Code: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW. hr = 0x80070006, The handle is invalid. Operation: Executing Asynchronous Operation Context: Current State: DoSnapshotSet ******************************************************************************************* Here is the XML details......... - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="VSS" /> <EventID Qualifiers="0">8193</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2016-09-06T12:18:02.441291700Z" /> <EventRecordID>11519</EventRecordID> <Channel>Application</Channel> <Computer>Surface</Computer> <Security /> </System> - <EventData> <Data>QueryFullProcessImageNameW</Data> <Data>0x80070006, The handle is invalid.</Data> <Data>Operation: Executing Asynchronous Operation Context: Current State: DoSnapshotSet</Data> <Binary>2D20436F64653A20534543534543524330303030303537392D2043616C6C3A20534543534543524330303030303536332D205049443A202030303030333830382D205449443A202030303030393131362D20434D443A2020433A5C57494E444F57535C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C53595354454D2C205349443A532D312D352D313820</Binary> </EventData> </Event>[/quote]

 

@thekochs,

Is you user profile folder still in the default "C:\Users" folder, and not moved to another location?


If you would like to test, I think I may have found something else to see if the script may be failing when trying to resolve the SID of the writer.

1) Open Registry Editor (regedit), and go to the key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

2) Look for the SID key (ex: S-1-5-21-2423704721-1541669065-2985363390-1001) that has the ProfileImagePath string value for your account's profile folder.

3) If you have another SID key with the same SID number with only .bak on the end (ex: S-1-5-21-2423704721-1541669065-2985363390-1001.bak), then this may be the issue.

4) Delete only the SID key with .bak on the end, and restart the computer. It is safe to delete only this key since it's only a backup of the currently used SID without .bak for your account's profile.

5) Test the script again to see if it works now.

 

YES, in Default

I don't have the SID key: S-1-5-21-2423704721-1541669065-2985363390-1001
....take a look at snapshot



The ProfileImagePath key is there under "my" -1001 SID key but no .BAK version of SID.

 

The SID would be unique per account per system, but that's ok. You didn't have one with .bak, so it rules that thought out.

 

@thekochs,

Ok. One more thing to test if you like. *Smile

Do you have system protection turned on for other drives than just the Windows C: drive?

If so, turn off system protection for all drive but C: to see if you area able to successfully have a restore point created by the script.

One of our other members Kari has reported this was the case for him, but they still work for me though.

 

I found it so incredible and illogical I had to capture it to video. It's unedited, just showing that if I have system protection enabled only for drive C: the scripts in this tutorial work perfectly creating a restore point, but as soon as I enable protection for another drive no restore points will be created.

Again disabling protection from other drives, restore points will be created. A total mystery. I of course understand that this what happens on my machines may not apply to yours.

[youtube]rEfSR4cDpR4[/youtube]

 

I only have a C: HDD to choose from....no others in system.
There IS a microSD card in my Surface micro SD slot that shows in File Explorer at "S:" (letter I assigned to it) but this does not show in System Restore as viable HDD for selection.....see snapshot below.
However, not sure how script works but since my "C HDD" is only maybe my system thinks like Kari it is "all".
Also, it would be good for Kari to show his "Event Viewer" for the times that the restore point was not created to see if he gets the same VSS error I got.





I hope you fix this and I see you in your script where you ID the O/S at W10 then do specific things.
If GetOS = "Windows 10" Then
Are you sure that 100% it will ID the O/S correctly and not some escape where the W10 "THEN" section is not run ?
If it wasn't run then what would be the results for the "ELSE" if was really W10 but not IDed as such ?

Also, something clearly changed in the W10 Version 1607 14393.82 to .105 build which is affecting your script calls.
https://support.microsoft.com/en-us/...update-history
I also had "Surface" updates to firmware/drivers but those were all power management items.
....since no other user has said they are on a Surface Pro 4 I assume it is MS update change.
Here is detailed link of the August 30th cum KB: https://support.microsoft.com/en-us/kb/3176938
Scroll down and you can download the Excel (csv) file of all the files that were updated in this KB.

In mean time I have taken my RP Task Scheduler item I created for daily (5pm) creation and just entered this command line instead of pointing to your VBS script. With the /c included it terminates process when done.
So, I get small window at 5pm a day when this runs and it closes when complete.
cmd.exe /c "wmic.exe /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "My Shortcut Restore Point", 100, 7"

Just so we are on same page this is the scrip of yours I'm running from my Desktop.
I copied it out of your ZIP and run it from there.



I went ahead and cleared my Event Viewer for you and ran this script from Desktop.
It did not create Restore Point but there is Event info..........

 

@thekochs,

If you're still up for testing, here's a stripped down to the bare basics .vbs file to run and see if it will now actually successfully create a restore point for you. This will help to see if some other part of the original script may be causing the error for you.

Test_W10_CreateRP-Success_Message.vbs

 

Hi, I have this running fine on C: + D: - on a previous PC, both were partitions on the same HDD, now on the same SSD.
Just wondering if there's a difference between two partitions and two physical disks- although I can't begin to imagine why..

Here's the vbs I'm using for confirmation.
Scheduled_Instant_Restore_Point.zip

 

It did not work.........gave me message to type in name, came back after 10-20seconds and said completed.
No RP created in list, VSS error in Event Viewer.
Any chance this is some permission issue I need to run script in some "mode" ?

 

Did not work.....looking at script it does not show W10 support for "GetOS" but tried anyway.
No RP created and gave me VSS error.

Note, creating one manually in Control Panel > System works fine.
Running........
cmd.exe /k "wmic.exe /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "My Shortcut Restore Point", 100, 7"
....works fine.

 

FYI...I also disabled Defender, MBAM & MBAE in the event they were blocking scripts....still did not work.
All I can summize is that the "call" to the VSS is no longer valid within the syntax of the request, etc.
Is there a simple non-VBS command(s) I can put in batch (BAT) file to test out from your "approach/code".
In other words, boil the creat RP down to single/base command and I put in BAT file and see if works ?

 

That would suggest there's clearly a difference between your Win 10 and mine.

 

Yup, this only starting failing on August 30th when the W10 Version 1607 14393.82 to .105 came out.

Also, with the other poster above talking about multiple HDDs I went ahead and attached a USB HDD which does show in Control Panel > System......and set to OFF for SysRest. I tried scripts....still same issue.

 

I have build 14393.105. I have s. restore scheduled daily for two partitions on my SDD- it works.