Solved

Deleting XP System Restore points remotely

Posted on 2006-06-13
3
1,512 Views
Last Modified: 2008-02-01
Due to virus issues, we are going to try and push out a disable and delete of all system restore points and functionality over our network.  We have found a registry key that should be easy enough to implement via GPOs (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR=1).  However, deleting the restore points themselves seems to be an issue, since just doing the regedit does not delete the prior points created.  The folder that the points reside in is restricted to SYSTEM access only (easy enough to implement in GPOs, since those authenticate as SYSTEM), however having an exact script to run is stumping us, as deleting the wrong thing could cause huge issues.

ANybody have experience with this problem?
0
Comment
Question by:Hyppy
3 Comments
 
LVL 3

Expert Comment

by:Tony Gimenez
ID: 16900194
The folder that the system restore points are located are C:\System Volume Information and enabling access is as simple as a batch/script file.

http://www.theeldergeek.com/system_volume_information_folder1.htm

Well anyway.. doing this over the network would take some sort of remote administration program, and if you dont have one already here are two good ones.

http://www.emco.is/remote_administration3/features.html
or
https://secure.logmein.com/go.asp?page=products_it

Oh and by the way, if I remember correctly once that registry value is changed the restore points are deleted upon next system reboot. So if you want to reboot all your computers on the LAN use this:

http://www.matcode.com/remoteshutdown.htm
(this is free, but with less functionality)

http://www.emco.is/remoteshutdownpro/features.html
(and this is the ultimate best)
0
 
LVL 6

Expert Comment

by:Booda2us
ID: 16900231

To delete all the restore points on your computer, disable and re-enable system restore on the system. Click Start, Control Panel, and then the System icon. Click on the System Restore tab in the dialog box, select the Turn off System Restore check box, and click Apply. Clear the check box again to re-enable System Restore and then click OK
You can use WMI scripts for remote restore, so you could use them to delete points as well..here is a link for any WMI questions you may have:
http://www.microsoft.com/technet/scriptcenter/guide/sas_wmi_vzbp.mspx?mfr=true
I hope this helps...Booda2us
0
 
LVL 4

Accepted Solution

by:
ADExpert earned 500 total points
ID: 16901165
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\default")
Set objItem = objWMIService.Get("SystemRestore")
errResults = objItem.Disable("")
errResults = objItem.Enable("")


Above mentioned is a vbscript which can be used to delete all local system restore points. You can change the "." in strComputer variable with the remote system name to perform the same operation on remote systems.

ADExpert
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Just about everyone has an old PC laying around.  Ask anyone in the IT industry, whether they are a professional or play in it as a hobby.  From outdated Desktops to cheap "throwaway" laptops, they are all around and not as hard to "fix up" as you m…
Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now