system restore 0x80070005

davexnet · 21 Aug 2018

I know there are many threads about this, I'm still looking and have been searching the internets
in earnest. But I'm hoping if I describe the things that influence the outcome somebody may have an
idea.
1)Panda Free anti virus was once installed, but no longer. I discovered the problem after it had been
uninstalled for a number of days.

2) System restore works in Safemode and also from the Windows RE (f10 key at start up)

3) It also works if I reinstall Panda anti virus.

4) Uninstalling Panda and reverting to Defender breaks it, this is confirmed now.

I did try the the reset under Recovery/Reset this PC (keep files). This did not affect the problem.
I may be looking at a repair install next. Tried DISM /restore-health and SFC /scannow to no effect

Thanks for reading, any idea's appreciated
EDIT disabling WD using group policy also allows SR to finish properly

dalchina · 22 Aug 2018

Good description and investigation. It seems your basic problem is that System Restore and Windows Defender conflict, which should be embarrassing for MS, really, being widely reported.

It could be interesting to discover whether any Defender settings help, I suppose.

I'm sure you've read the many reports of this noting the standard recommendations to disable any AV (including Defender) and do exactly as you have done. I therefore doubt any standard repairs will help- it seems an intrinsic deficiency one has to work around.

davidhk · 22 Aug 2018

TO : davexnet
My computer is running Win 10 Home 64-bit, ver 1803 build 17134.228.
I have no 3rd party AV installed. Running only Windows Defender.
After reading your post, I did a system restore.
It went through successfully.
At least in my system, WD does not block system restore.

system restore 0x80070005-system-restore.jpg

dalchina · 22 Aug 2018

Thanks- that's perhaps part of the confusion- that others have encountered problems even with Defender seems embedded in the many recommendations to disable Defender or turn to e.g. Safe Mode before running SR when encountering this error, whilst others don't find this happening.

A bit like the 'Help, my desktop icons won't stay where I put them' problem perhaps- some are plagued with it- many others never see it.

lafargeotte · 22 Aug 2018

davexnet said:

I know there are many threads about this, I'm still looking and have been searching the internets
in earnest. But I'm hoping if I describe the things that influence the outcome somebody may have an
idea.
1)Panda Free anti virus was once installed, but no longer. I discovered the problem after it had been
uninstalled for a number of days.

2) System restore works in Safemode and also from the Windows RE (f10 key at start up)

3) It also works if I reinstall Panda anti virus.

4) Uninstalling Panda and reverting to Defender breaks it, this is confirmed now.

I did try the the reset under Recovery/Reset this PC (keep files). This did not affect the problem.
I may be looking at a repair install next. Tried DISM /restore-health and SFC /scannow to no effect

Thanks for reading, any idea's appreciated
EDIT disabling WD using group policy also allows SR to finish properly

Apart from the error code, what does the fail message say after System Restore fail.

dalchina · 22 Aug 2018

Note: that text seems the only information you'll get - the event log doesn't contain anything helpful, and people seem to believe there's no log file.

Example posted here:
How to Fix System Restore Error 0x80070005 on Windows 10?

referring to a file in use e.g. by an AV program.

System Restore could not access a file. The s probably because an anti-virus
program is running on the computer. Temporarily disable your antivirus program and
retry System Restore.

An unspecified error occurred dung System Restore. (0x80070005)

davexnet · 22 Aug 2018

dalchina said:

Note: that text seems the only information you'll get - the event log doesn't contain anything helpful, and people seem to believe there's no log file.

Example posted here:
How to Fix System Restore Error 0x80070005 on Windows 10?

referring to a file in use e.g. by an AV program.

Yes this is the message. Why would MS not document or identify the particular file somewhere? That's odd.
I suppose I could leave the situation as-is and just use the WinRE to do my restores, but to be safe I would probably
first do a normal restore, let it fail then actually restore from WinRE. If I don't do this the "undo restore" point
does not get created.
Some of the other posts, talk about file permissions (or registry), but once again without a log, who knows for sure.

I rebuilt the WD folder structure and the condition persists. I renamed the complete Windows Defender
folder in \program files\ rebooted and immediately ran SFC /scannow which rebuilt it successfully according to cbs.log
But the problem still persisted. (Strange thing is with the WD folder missing, Windows booted up without any problems
not even an error message or other hiccup)
Thanks everybody for your responses.

dalchina · 22 Aug 2018

Really important - use disk imaging routinely. SR is thought unreliable as there are other scenarios where it fails just when you'd like it not to. Also, disk imaging helps when your disk fails (new disk) or your PC is unbootable/unrecoverable otherwise.

E.g. Macrium Relect (free) + external storage for disk image sets.

davexnet · 22 Aug 2018

dalchina said:

Really important - use disk imaging routinely. SR is thought unreliable as there are other scenarios where it fails just when you'd like it not to. Also, disk imaging helps when your disk fails (new disk) or your PC is unbootable/unrecoverable otherwise.

E.g. Macrium Relect (free) + external storage for disk image sets.

Appreciate the suggestion - of course it's common sense advice but I must admit
I do not have it in place right now. Touch wood, I have never had a HDD physically fail on me.
I will look into Macrium Reflect and educate myself on the backup philosophy.

In the XP days they had a program called srdiag that you could run after SR failed. It gave
detailed logs of what SR did and where/why it failed. In some cases I was able to "fix" it and
SR subsequently worked.

Those were the days!

EDIT another thought occurred to me, since disabling WD with GPEDIT takes effect immediately
I can do my System Restore then. Saves me time, no initial reboot needed and I can avoid
Safemode or WinRE.
Still, I wish I could find out exactly what is causing the 0x80070005

dalchina · 23 Aug 2018

I guess there are two possibilities- in the case of SR failure like this in normal mode, some scan by WD is in place by SR when SR is invoked. Or, the act of invoking SR triggers WD, and that activity then conflicts with SR.

One might then think - surely MS would ensure WD would back off in the face of SR so there could be no conflict?

I could more easily understand this being an issue with 3rd party AV (although the argument then applies the authors could equally design their progs to avoid such a conflict).

Disk imaging: we've had threads here where people have had disk failing, and no means of recovery. So they are forced to do a clean install.

There are two basic weaknesses of disk imaging:
a. If you discover an uncorrectable problem but don't know the cause or when it was caused, you may not have an old enough isk image- and even if you did, it would be guesswork, and you might not wish to restore a really old image anyway.

But the same goes for SR too.

b. Unlike SR, disk imaging restores partitions or disks. So that includes all data too. SR doesn't affect data.