Hyppy
asked on
Deleting XP System Restore points remotely
Due to virus issues, we are going to try and push out a disable and delete of all system restore points and functionality over our network. We have found a registry key that should be easy enough to implement via GPOs (HKEY_LOCAL_MACHINE\SOFTWA RE\Microso ft\Windows NT\CurrentVersion\SystemRe store\Disa bleSR=1). However, deleting the restore points themselves seems to be an issue, since just doing the regedit does not delete the prior points created. The folder that the points reside in is restricted to SYSTEM access only (easy enough to implement in GPOs, since those authenticate as SYSTEM), however having an exact script to run is stumping us, as deleting the wrong thing could cause huge issues.
ANybody have experience with this problem?
ANybody have experience with this problem?
To delete all the restore points on your computer, disable and re-enable system restore on the system. Click Start, Control Panel, and then the System icon. Click on the System Restore tab in the dialog box, select the Turn off System Restore check box, and click Apply. Clear the check box again to re-enable System Restore and then click OK
You can use WMI scripts for remote restore, so you could use them to delete points as well..here is a link for any WMI questions you may have:
http://www.microsoft.com/technet/scriptcenter/guide/sas_wmi_vzbp.mspx?mfr=true
I hope this helps...Booda2us
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
http://www.theeldergeek.com/system_volume_information_folder1.htm
Well anyway.. doing this over the network would take some sort of remote administration program, and if you dont have one already here are two good ones.
http://www.emco.is/remote_administration3/features.html
or
https://secure.logmein.com/go.asp?page=products_it
Oh and by the way, if I remember correctly once that registry value is changed the restore points are deleted upon next system reboot. So if you want to reboot all your computers on the LAN use this:
http://www.matcode.com/remoteshutdown.htm
(this is free, but with less functionality)
http://www.emco.is/remoteshutdownpro/features.html
(and this is the ultimate best)