MDT 2010 Update 1: Fix to re-enable System Restore in ConfigMgr task sequence

Some people noticed that during an OS deployment task sequence, performed either by MDT 2008 Lite Touch or by ConfigMgr, could capture sensitive information (from unattend.xml, variables.dat, etc.) as part of the automatic System Restore snapshot process that happens whenever a new driver, application, security update, etc. is installed.

To address that issue, we added some logic in MDT 2010 to disable System Restore by configuring the default unattend.xml template:

<component name="Microsoft-Windows-SystemRestore-Main" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">

We then added logic to re-enable that at the end of the deployment process – but only for Lite Touch.  (You can see that logic in LTICleanup.wsf.)  We discovered later that this was left out of the ConfigMgr scripts.  So as a result, machines deployed using ConfigMgr and an MDT 2010 task sequence template ended up with System Restore disabled.

In MDT 2010 Update 1, we added logic to address this.  Now, System Restore will be re-enabled at the end of the deployment even with ConfigMgr.  (Because we don’t have the equivalent of LTICleanup.wsf in a ConfigMgr task sequence, the logic was added to ZTICopyLogs.wsf, the last script to run during an OSD task sequence.)


Comments (11)
  1. You don't even need to rename the "GetObject" function, just delete it altogether.  I'm not sure how that one slipped through…

  2. ConfigMgr #1 Fan says:

    Does this exclude servers such as Windows Server 2008 / Windows Server 2008 R2 where System Restore is disabled?

  3. Sam R. says:

    We're still getting Win7 deploys with SystemRestore turned off. After reading this post I took a look at the EnableSystemRestore function in LTICleanup.wsf, grabbed it and ran it as a standalone VBS – still nothing. Then I commented out the On Error statements and got the following:

    Microsoft VBScript runtime error: Type mismatch: 'oEnv'

    I am currently testing with the following code for Function EnableSystemRestore (yeah its probably ugly, if it works I don't care):

    Dim iRetVal, oSRP

    strComputer = "."

    On Error Resume Next

    Set objWMIService = GetObject("winmgmts:\" & strComputer & "rootdefault")

    Set oSRP = objWMIService.Get("SystemRestore")

    iRetVal = oSRP.Enable("")

    On Error Goto 0

    EnableSystemRestore = iRetVal

  4. Sam R says:

    Bah, my VB king-fu is weak. Still, LTICleanup is running out of juice somewhere between copying the logfiles to windowstemp and re-enabling SystemRestore. The minint folder is still there, with only a couple of files in it – that may be a clue. Adding lots and lots of logging entries and trying again…

  5. Craig Walls says:

    We've just been troubleshooting the LTICleanup.WSF script and discovered that there is a FUNCTION declared called GetObject which is breaking the script.

    We've renamed the function to LTIGetObject and now the script does more of the things it's supposed to… 🙂 The GetObject function doesn't actually seem to be called by anything, so as far as I can tell it was only put in to ruin my day…

  6. Jay.lambert says:

    Are there any side effects after changing the name of that function? i am having the same problem and i am testing your theory now.

  7. Jay.lambert says:

    Craig Walls Post worked for me. Thanks! i have been trying to figure this out all day…

  8. adam says:

    What is the fix for those machines that have already been deployed before catching that System Restore is disabled.  To my knowledge, there is no option via GPO to "enable" system restore – only an option to disable it.

    Any ideas on that guys?

  9. MHousler says:

    Is there any easy way to turn it back on to systems I've already pushed out?  I have probably 30 machines out there before I figured it out and found this thread 🙁

  10. Rhonda B. says:

    We have this exact issue in SCCM 2012 SP1 with MDT 2012 integrated.  I see in the sms log that zticopylogs.wsf runs; however system restore is not turned back on.  

  11. aw says:

    hai, I just want to tell you that I am just very new to blogs and seriously loved this website. More than likely I’m planning to bookmark your blog post .
    You amazingly come with really good posts. Thanks a lot for sharing your blog Microsoft.

Comments are closed.