System Restore service not available

System restore service is not available.

The message I get is:

    Could not start the System Restore service on local computer.
    Error 2: The system cannot find the file specified.

I have tried restarting the service from the system services snapin, it will not sart.
I tried command prompt: net start (service name) and no dice.

If I go to System Properties, there is no tab for system restore.

Any suggestions ?
Thanks to all in advance ! Jennifer.
Who is Participating?

Improve company productivity with a Business Account.Sign Up

johnb6767Connect With a Mentor Commented:
Process Monitor

I am not sure how comfortable you will be with this process..... So please advise if I lose you.....

DL and launch the above. A TON of data is going to start passing by. Hit the blue filter button at the top. Set the filter (similar to the screenshots in the bottom link) to....

Process Name      is      mmc.exe      Include, then hit ADD.

Display should stop for a moment.....  Go to Services, and you should start seeing data fly by again. Highlight The System Restore Service, and hit the "Clear Log" icon at the top (immediately left of the blue filter). Then try and start the service. Once it errors, save the log file as indicated in the link and compress it, and attach it here.....

How to Use Process Monitor to Track Events and Generate a Log File

Sudeep SharmaTechnical DesignerCommented:
I would recommend you to run sfc /scannow from the command prompt. Just make sure you have the WIndows CD with you before you run that.

Dr. KlahnPrincipal Software EngineerCommented:
Go to Start, Control Panel, Administrative Tools, Services.  Click the "Standard" tab at the bottom.  See if the System Restore service is present, as below:

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

The first idea I have for you

Right click the "C:\WINDOWS\inf\sr.inf" (or where ever your windows are installed) select "install" This will fix your System restore.  You will be prompted for files, so you will probably need your XP install disk if the files are not on the drive.
Dr. KlahnPrincipal Software EngineerCommented:
... ah, I was going to continue that thought, but hit the wrong button:

If the service is not shown at all, then there is a severe registry problem.

If the service is shown, then right-click on it and investigate the Properties pages.  They should appear as below:

Properties page
Properties page
Properties page
Note that the System Restore service depends on the RPC service.  If RPC is disabled, System Restore will not start.

Also investigate the system error logs to see if any apropos messages are showing up.

OP says it is there, but won't start.  Error 2 System can not find the file specified

I'm thinking there would have been a message re RPC not started if your theory were true.

This could be caused by permissions (or Malware), but wanted to have her try reinstalling SR first to make sure all the components were present in the system and properly registered.

Good idea about the system error logs.


Re system error logs

View the event logs to investigate System Restore service errors
To do this, follow these steps:

   1. Click Start, click Run, type eventvwr.msc /s in the Open box, and then press Enter.
   2. Click the System category.
   3. Click the Source tab to sort by name, and then look for "sr" or "srservice." Double-click each of these services, and then evaluate the event description for any indication of the cause of the problem.
ccbonAuthor Commented:
Well I'm not sure what happened but I'll try this again. If it's in there twice, sorry:  

The sfc scannow I did run with my install cd and it completed with no messages.
I restarted the machine, still no src.

I cannot find any file on my system called sr.inf - I looked carefully.

I did go to the services area and System Restore Service is listed, you'll see this in the screenshot I'll add to this. Also, the service upon which it depends, rpc is running.

Note that when there this time I clicked to restart that service again, but this time, instead of the error 2 it was originally giving, it says a slightly different error. See the screenshot for the error detail.  That's a bit weird.
ccbonAuthor Commented:
ccbonAuthor Commented:
Also, all entries I could find in the system events logs regarding that service simply said that the service stopped for unknown reasons. These were listed as svshost events, not specifically under the service name.
ccbonAuthor Commented:
to Jim-R:  Well I was wrong about that file sr.inf - I apparently had my search settings set to skip hidden files.
Yes it was there, in Windows\Inf.
I right-clicked on it, and used my install cd to install it, it asked me to restart the computer, which I did.
The service is still not there. This is FRUSTRATING !
The sr.inf should be in the Windows directory.  The file may have been deleted by malware, but it is supposed to be there.  There should also be a hidden folder named "System Volume Information" which you will not see unless you have set the option under Tools->Folder Options in Windows Explorer.  The "inf" extension is not allowed to be uploaded, but if you change the file extension on the attachment from TXT to INF you will have re-created your own INF file.  The contents of the following code box is what is inside the txt file so you know what you are getting.  Put this file in the Windows folder.

In Windows Explorer using the "Tools->Folder Options menu, select the "View" tab and make sure you have the "Hide extensions for known file types" UNchecked, so you know the file extension will be dot INF and not dot INF dot TXT.














DisplayName    = %SR_Filter_Name%
ServiceType    = 2    
StartType      = 0    
ErrorControl   = 1    
ServiceBinary  = %12%\sr.sys
LoadOrderGroup = "FSFilter System Recovery"

DisplayName    = %SR_Service_Name%
Description    = %SR_Service_Desc%
ServiceType    = 0x20  
StartType      = 2     
ErrorControl   = 1     
ServiceBinary  = %11%\svchost.exe -k netsvcs
Dependencies   = "RpcSs"




HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys","",0x00000000,"FSFilter System Recovery"
HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sr.sys","",0x00000000,"FSFilter System Recovery"



HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore","DisableSR",0x10001,0
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore","CreateFirstRunRp",0x10001,0
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\Cfg","DiskPercent",0x10001,12
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\SnapshotCallbacks"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Run","SRFirstRun",,"rundll32 srclient.dll,CreateFirstRunRp"




HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SvcHost","SRGroup"

HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\FilesToSnapshot"

HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore"




SR_Filter_Name  = "System Restore Filter Driver"

SR_Service_Name = "System Restore Service"
SR_Service_Desc = "Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties"

SR_UI_Link_Name    = "System Restore"
SR_UI_Link_SubDir  = "Accessories\System Tools"

Open in new window

Dr. KlahnPrincipal Software EngineerCommented:
The next step would be to perform a Window repair installation.

Personally, when I have come to that stage, I reinstall Windows instead.  My own experience is that "repaired" systems are never quite right.
Ok, I missed your post while I was making mine.

When you say the service is still not there, are we talking the existence of it in the "Services" dialog listings, or just that it still won't start?

My next suggestion was for you to check some policy setting to make sure a policy wasn't over riding, but the reinstall of SR should have taken care of that.

My next suggestion will be for you to attempt to run the service from a command prompt in Safe Mode, but you will likely have to re-install SR AGAIN, but only allow restart in Safe Mode (to prevent the installation from being re-sabotaged).  If this allows SR to run, you likely have Malware that is causing your issue and should re classify your tagging of your question to the AntiVirus category where our most excellent AntiVirus experts who watch this category can help you.
Oops, I guess you'll need that procedure.

Boot in safe mode and run the System Restore tool
To boot in safe mode follow these steps:

   1. Restart the computer. Immediately after the screen goes blank for the first time, or after the BIOS post ends, start taping the F8 key repeatedly. The Windows Advanced Options menu appears.

      If the menu does not appear, restart the computer and try again.
   2. Select Safe Mode, and then press ENTER. As files load they will scroll down the screen.

      Note Safe mode uses a minimal set of device drivers and services to start Windows. The default Microsoft VGA driver is used for display at 640 X480 resolution and in 16 colors.
   3. Log on to the Administrator account. If a password was never set, leave the password blank and press ENTER or click the green arrow.
   4. Click No in the safe mode information screen to start System Restore.
   5. Select Restore my computer to an earlier time, and then click Next to proceed to select a date with restore points available.
   6. Click Next to begin restoring the system to a previous state.
ccbonAuthor Commented:
To Jim-R
By "still not there" I meant that it still won't start.
It does still show up in the list of services.
I did take the inf file you posted and renamed it .inf, and put it into the
specified directories.

When I restarted the system, I got "system restore" available on my start menu\programs\accessories\system tools, which wasn't there before.
When I clicked on it, it said (something to the effect of) The system cannot protect your computer. Please restart and run System Restore again.
And upon doing that, still no help.
Again, I went to Services and tried to restart the service, to no avail.

To DrKlahn: I know what you're saying about a sysem repair, but to me it would make more sense to wait until I have to do a system restore and cannot, THEN I'd have to try either an os reinstall or at least a system repair. At this time, though, it's not preventing me from normal operations on this machine.
The ServiceDLL for the SRService is C:\WINDOWS\system32\srsvc.dll

Is this file present?


type the following please....

set path

Post the output please....


System Restore as a built in diagnostics.... If the following file is present, double click it.


It will create a %COMPUTERNAME% .CAB file. Double click it, and extract (just highlight and drag to your desktop)the .txt files at the bottom, that are named SR-FileList.LOG and SR-Reg.LOG. Attach them here please....
ccbonAuthor Commented:
To JohnB:
The srsvc.dll file is there.
The set path result will appear below.
My \system32\restore folder does have that srdiag.exe file, but when
tried to run it, nothing happened - or I should say, I didn't find the
resulting .cab file from it.  Tried re-running it from the command prompt,
still didn't see any resulting diagnostic output.  Perhaps I'm doing something wrong there.
ccbonAuthor Commented:
I have procmon (process monitor) already, got it from Nirsoft utilities.
Same one ?
ccbonAuthor Commented:
I was finally able to get that to run.

When I created the filter to include process name=mmc.exe, it filtered ALL events.

Also, there was nothing labeled "Services" anywhere the output or the options.

(The link you included for that utility (procmon.exe) didn't work, so I went to Microsoft Sysinternals site and downloaded it from there.)
ccbonAuthor Commented:
Ignore that last comment; I misunderstood your telling me to go to services again. You meant that while the pcomon.exe was running, you wanted me to try to restart the service so it would monitor whatever went wrong when I did that.
Sorry,  I'll try that again.
You got it.... Go to services and start it while it is monitoring....
ccbonAuthor Commented:
Done.  I have an output file (I opted for the .pml filetype).
I compressed it to a .zip folder. However, E.E. gives me an error message
when I try to upload that. It says that the file type within the folder is not an allowed one, so it won't uplaod the .zip folder.

The size of the UNzipped .pml log file is 5.3 mb, whereas the zipped vers.
is around 1.2 mb.

I also created the logfile as a .csv file, which without compression is slightly over 2 mb.

I can upload that unzipped .csv file, or if you know how to get around E.E.'s objection to that .zip folder/file deal, I can try that another way.

I'll stand by to hear what you suggest.
Just rename it to .txt, and upload the .PML file...
ccbonAuthor Commented:
Cant DL it..... Can you please upload again?
ccbonAuthor Commented:
Don't think that will be necessary, BECAUSE, I just for the heck of it tried to start system restore service, and it WORKED.  
I did a test restore and it worked perfectly.

I don't know when that came back, but I have to presume that because I've been working with you for the past several days, it was something you had me do somewhere along the line.

So I am going to award to you the points, with a big THANK YOU.
Attaching a snapshot of the now WORKING restore !
ccbonAuthor Commented:
Can't precisely say what it was that fixed the problem, but I know it was one of the fixes this expert suggested.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.