Your PC restarted after a driver installation, and now Windows won't get past the loading screen. Or the desktop still opens, but the application you need keeps crashing and Settings won't cooperate. Before you consider reinstalling Windows, check whether a restore point can take the system back to a working configuration.
System Restore using Command Prompt gives you another way to reach that recovery tool. The command is short. The important work is choosing the right restore point, targeting the correct Windows installation, and recognizing when you need a different recovery method.
When Command Prompt Becomes Your Recovery Lifeline
A broken desktop doesn't necessarily mean you've lost access to Windows recovery tools. You may still be able to open an administrative shell, even when navigating through Settings isn't practical. If Windows won't start, Windows Recovery Environment, usually shortened to WinRE, provides a separate route.
Microsoft lists System Restore as available in Windows 10 and Windows 11, with rstrui.exe as the command-line entry point from an administrative Command Prompt or WinRE. That makes it a useful starting point across both versions, as described in Microsoft's System Restore guidance.
Choose your starting point
Your next move depends on what still works:
- Windows reaches the desktop: Open a Command Prompt with administrative privileges and launch the restore wizard.
- Windows won't finish booting: Use WinRE to reach System Restore directly or open Command Prompt.
- The wizard opens but offers nothing useful: Investigate the available restore points before trying more commands.
Command Prompt isn't a separate restoration engine. It launches the same recovery interface you'd normally open through Windows menus. You won't complete the entire rollback by typing commands into a text window.
Practical rule: Treat the shell as an entrance to recovery, not as a way to bypass missing restore points or an inaccessible Windows installation.
That distinction prevents a frustrating detour. If a menu shortcut is broken, another launcher may help. If the underlying recovery information is missing, changing how you launch the tool won't replace it.
Before proceeding, write down what changed immediately before the failure. A driver installation, an application update, or a configuration change gives you a useful boundary when choosing a restore-point date.
How System Restore and Restore Points Work
A restore point captures system configuration and settings at a particular moment. Restoring it returns protected system files, Registry settings, and installed programs to that earlier state while leaving your personal files untouched. Applications, drivers, and Windows updates installed after the selected point can be removed in the process, according to Microsoft's explanation of backup, restore, and recovery.
Say your display started malfunctioning right after a driver installation. A restore point created before that install may be a relevant rollback target. A point created after the malfunction began no longer represents the working configuration you want.
That is the core skill here: reading a timestamp correctly.
Understand what you're choosing
| Item | What the restore point means |
| System configuration | An earlier set of protected files and settings |
| Installed software | Programs or drivers may change during rollback |
| Personal documents | Not a historical copy of your documents |
| Complete disk contents | Not a full-system image backup |
The timestamp matters more than picking the newest entry in the list. You need a point that predates the suspected cause; a recent-looking entry created after the break only preserves the broken state.
The feature has a long history behind it. System Restore appeared in Windows Me in 2000, continued in Windows XP in 2001, and became accessible through WinRE with Windows Vista in 2006, as documented in BetaWiki's System Restore history. That continuity explains why the executable name remains familiar in Windows troubleshooting today.
A restore point is a snapshot of system configuration. Your documents, photos, and downloads sit outside its scope.
Keep that boundary clear before authorizing a rollback. If your real problem is a missing document, file recovery is the tool you want, and a configuration rollback will not bring it back.
Returning to the selected state also has a cost. You may need to reinstall legitimate software afterward. List anything important that was installed between the restore-point timestamp and the failure, then compare that list with the wizard's affected-program results when you reach them.
Running rstrui.exe from an Elevated Command Prompt
On a PC that still reaches the desktop, search the Start menu for Command Prompt, choose Run as administrator, and approve the elevation prompt. Use the administrative shell rather than assuming an ordinary Command Prompt has the permissions you need.
Type rstrui.exe and press Enter. The graphical System Restore wizard should open. Seeing a window appear is expected, even though you launched the process from a command line.
Make the decision in the wizard
Choose Next, then enable Show more restore points if that option appears. Compare the available dates with your notes about when the problem began. Don't select an entry solely because its description sounds reassuring.
- Check the timestamp: Choose a configuration from before the suspected breaking change.
- Select Scan for affected programs: Review the software and drivers the rollback could remove.
- Record your choice: Save the selected date and any affected applications you may need to reinstall.
- Confirm deliberately: Read the final summary before starting the restore.
Although the affected-program scan is optional in the interface, treat it as a required check in your own workflow. Microsoft includes it in its documented System Restore selection process.
Know when the offline switch belongs
The documented offline form is rstrui.exe /offline:C:\Windows=active. It identifies the Windows installation at the specified path as the active offline target when you're working from a different boot source.
Don't add /offline to an ordinary desktop launch just because it looks more thorough. For the currently running installation, the plain command is the normal starting point. The offline form belongs to a different situation: your recovery environment is running separately from the Windows installation you're repairing.
The C: in that example isn't a promise about your machine. Before using an offline command, confirm the target's actual drive letter using the recovery checks below.
Reaching rstrui from Windows Recovery Environment
If Windows won't boot, use the computer's recovery environment or Windows recovery or installation media to reach WinRE. The exact entry method depends on the machine and the recovery options available, so avoid assuming that a particular startup key works everywhere.
Within WinRE, the direct route is Troubleshoot > Advanced options > System Restore. You may need to authenticate with an administrator account. If you need the command-line route instead, choose Command Prompt from Advanced options.
Verify the Windows volume before targeting it
Drive letters in WinRE may differ from those in normal Windows. The installation you remember as C: might appear under another letter. This is a reason to inspect the volumes, not a reason to guess.
Use these commands separately:
- Open the volume utility: Enter diskpart.
- Inspect the volumes: Enter list volume and examine the listed letters, labels, and sizes.
- Leave the utility: Enter exit to return to Command Prompt.
- Check a candidate installation: Enter dir D:\Windows, replacing D: with the letter you're checking.
Don't enter dir commands while you're still inside DiskPart. Also, listing volumes doesn't require formatting, deleting, or changing partitions. Keep this inspection read-only.
Microsoft's restore-point troubleshooting guidance supports verifying the Windows volume before offline repair work. Once you've identified the installation, run rstrui.exe, or use the documented offline form with the verified letter substituted.
The visual below summarizes the desktop launch sequence; the volume check is the additional precaution that matters when working offline.
Validate the result
After restoration and restart, test the symptom that brought you here. Does Windows reach the desktop? Does the previously failing application open? Is the problematic driver change gone?
A completed wizard isn't your only success criterion. The useful outcome is a bootable, usable system without the triggering problem. If the restore fails, record the exact error rather than immediately repeating the same attempt.
Why No Restore Points Show Up and What You Can Do
An empty restore-point list doesn't necessarily mean you typed the command incorrectly. First confirm that you're inspecting the intended Windows installation, especially if you're working in WinRE. Then distinguish no snapshots available from snapshots available but unsuitable.
As noted in the earlier troubleshooting guidance, points may be unavailable because System Protection was disabled, storage was exhausted, or existing points were deleted or invalidated. A point can also be useless for your particular problem if it was created after the failure began.
Investigate the cause, not the launcher
If you can return to a working Windows session, search for Create a restore point to inspect System Protection. Select the relevant system drive and examine its protection configuration.
- Protection is disabled: Enable it for future recovery, but don't expect that action to produce a snapshot from before today's failure.
- Storage allocation is constrained: Review the current usage and maximum-usage slider. Give future restore points room without assuming that increasing the limit brings deleted points back.
- Only recent points remain: Compare their timestamps with the first appearance of the problem.
- The correct drive still has no entries: Stop searching for a special rstrui.exe switch that can manufacture an earlier state.
A new restore point captures the configuration you have now. Creating one while the computer is malfunctioning doesn't give you a healthy historical target, and waiting won't make that new point represent an earlier installation.
Stop condition: If there's no usable snapshot, more attempts to open the same wizard won't create one.
Follow the appropriate branch
| What you find | Sensible next action |
| Wrong Windows installation selected | Correct the target and inspect again |
| Usable point predating the failure | Review its affected programs and consider restoration |
| Points exist, but all postdate the failure | Choose another recovery method |
| No points exist | Preserve data and investigate backup-based recovery |
If a listed point fails, retain the error message and the point's timestamp. Another suitable point may warrant consideration, but repeatedly retrying a damaged snapshot isn't a recovery plan.
When System Restore Is the Wrong Tool
Choose the recovery tool according to what needs to be recovered. A recent software problem, a missing personal file, and a failing drive aren't interchangeable incidents. Microsoft separates the available approaches in its Windows recovery options overview.
Match the remedy to the loss
| Situation | Better recovery direction |
| A recent configuration change caused trouble | Consider a suitable restore point |
| A personal document was deleted | Look for a file backup or recoverable version |
| The operating system needs complete image recovery | Use an existing system-image backup |
| Corruption persists beyond targeted recovery | Consider Windows reset or a clean installation |
| Storage hardware is failing | Prioritize data preservation and hardware assessment |
Full-image recovery is a different operation from launching rstrui.exe. The command wbadmin start sysrecovery belongs to full-system recovery from an existing backup, runs in WinRE, and requires an administrative prompt. It isn't an alternative spelling of System Restore or a command to run experimentally.
For missing documents, check the backup system you configured, such as File History or a service with recoverable file versions. Don't assume that a synchronized folder alone guarantees a suitable historical copy.
Stop before recovery makes the situation worse
Ransomware damage requires more than a configuration rollback. A restore point isn't a dependable way to reverse encrypted personal files, and an apparently successful rollback shouldn't be treated as proof that a compromised machine is safe.
Suspected disk failure also changes the priority. Preserve accessible user data before repeatedly attempting software repairs on unreliable storage.
Recovery is successful when you've addressed the actual failure, not simply when a tool reports completion.
If you're considering a reset or clean installation, pause to confirm your backups and understand the selected operation's effect on files and applications. Escalating recovery should be a deliberate decision, not the next button you press out of frustration.
Habits That Make the Next Recovery Easier
Prepare while Windows is working. Open System Protection, check the system drive, and confirm that protection is enabled with an appropriate storage allocation. Then launch rstrui.exe occasionally to inspect whether usable restore points are present, canceling before any restoration begins.
A visible setting isn't the same as a verified recovery option. Checking the list closes that gap and gives you a chance to fix preparation problems before a failed startup makes everything harder.
Keep recovery information outside the affected PC
Maintain a short recovery note somewhere you can reach without the Windows desktop. Include how you access WinRE on your machine, where your backups live, and how to obtain any required administrator credentials.
Keep your BitLocker recovery key accessible before starting recovery work. If an encrypted volume needs to be decrypted, you don't want the only copy of the key stored inside that same inaccessible installation.
- Protection enabled: Recheck the correct drive after major configuration changes.
- Restore points verified: Inspect the available list rather than assuming snapshots exist.
- Personal files backed up: Maintain a dedicated backup process separate from System Restore.
- Image recovery prepared: If you rely on a system image, know where it is and how you'll access it.
- Recovery credentials available: Store the necessary account details and encryption recovery information securely.
- Recent changes recorded: Note important driver, application, and update changes to simplify diagnosis.
Test preparation without triggering a rollback
You can inspect restore points, read their descriptions, and review recovery choices without committing to restoration. Use that opportunity to become familiar with the interface when you're not under pressure.
For an additional visual walkthrough, use the video below alongside the command and target-volume checks.
Your immediate preparation task is straightforward: check protection, verify a restore point, and confirm that an important file is recoverable from your separate backup. Those checks give you evidence that your recovery plan contains more than a command you hope will work.
NeoTeo offers practical software tutorials, troubleshooting guides, and hardware explainers for readers who want to understand their PCs. Visit NeoTeo for more hands-on guidance, and use this recovery checklist to prepare your Windows system before the next startup problem.
