What does Windows System Restore exactly back up and restore?

Restored:

  • Registry (note: some current values will persist)
  • Profiles (local only—roaming user profiles not impacted by restore)
  • COM+ DB
  • WFP.dll cache
  • WMI DB
  • IIS Metabase
  • Files with extensions listed in the Monitored File Extensions list

Not Restored:

  • DRM settings
  • SAM hives (does not restore passwords)
  • WPA settings (Windows authentication information is not restored)
  • Contents of the My Documents folder(s)
  • Specific directories/files listed in the Monitored File Extensions list
  • Any file with an extension not listed in the Monitored File Extensions list
  • Items listed in both Filesnottobackup and KeysnottoRestore (HKLM->System->ControlSet001->Control->BackupRestore->Filesnottobackup and keysnottorestore)
  • User-created data stored in the user profile
  • Contents of redirected folders