System Restore points all disappeared except one system- created point

Hello:

I generally create a system restore point manually-daily. I dont rely on windows to create it for me.
I allow lots of space (~30%) of drive for SR. I recently decreased it to 20% when i noticed way more RP's than I needed.

Yesterday, I noticed all of the Restore Points-but one- were gone. There was only a System created point. SR was nowhere near the limit for FIFO to kick in! This had happened before. And when it did, I was able to continue creating points at will with no further issues. I had paused WU for a week--prior to all this..So there was no WU to generate such a System point

However I noticed that the system-created point was unusually small in size. ~300 MB. Generally my SR points are closer to ~1 Gig each. I tried creating a few more manual RP's. Yet with 5 restore points the total size is still only ~700MB. So I'm concerned if these are truly functional RP's? I'm not sure how to diagnose this

I can think of several approaches here:

1) Attempt an actua system restore to the most recent point and see if its really working as should. And if so, all is well..But this might be a bit draconian..

2) Delete all but most recent RP's and see if "flushing the system" that way resolves this

3) Attempt to diagnose if there are any issues in the Volume Shadow service via EventViewer.

I had forgotten exactly how to find System restore issues in EventViewer. Where exactly do I navigate to to find those events?
======================
Any suggestions as to how best to proceed to ascertain whether those points and future points are functional given that they are much smaller in size than I'm used to?

Thanks:
Eliuri
Windows 10 1903

See what happens with these steps:

1) Click win + r keys (simultaneously)
2) type or copy and paste: services.msc
3) search on the list for each:
a) volume shadow copy
b) microsoft software shadow copy provider

For each right click and change:
status > automatic
services > started

reboot

In the event viewer there can be entries related to shadow copies:

Code:

Event ID:  25  The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.

Code:

Event ID: 24  There was insufficient disk space on volume C: to grow the shadow copy storage for shadow copies of C:.  As a result of this failure all shadow copies of volume C: are at risk of being deleted.

Code:

Event ID: 35  The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.

Code:

Event ID: 30  An unfinished create of a shadow copy of volume C: was deleted.

Create System Restore Point in Windows 10
Change System Restore Point Creation Frequency in Windows 10
Automatically Create System Restore Point on Schedule in Windows 10
Automatically Create System Restore Point at Startup in Windows 10

Thank you, Zbook.

Both those services were set to Manual. I reset them to Automatic and started those services. Rebooted and they were still on Automatic and running.. I know Volume Shadow Copy often turns itself off when not in use though..

As to the EventViewer: Where exactly should I navigate in the Event Viewr app to find entries such as the ones you mentioned?

eliuri said:

Yesterday, I noticed all of the Restore Points-but one- were gone. There was only a System created point... I noticed that the system-created point was unusually small in size. ~300 MB. Generally my SR points are closer to ~1 Gig each....


...Any suggestions as to how best to proceed to ascertain whether those points and future points are functional given that they are much smaller in size than I'm used to?

Thanks:
Eliuri

Windows 10 1903

And when did you get the feature update to 1903? See your Update History to find out.

If that was a day or so ago then it explains why all your restore points were deleted. A restore point from an earlier version Windows cannot be applied to a later version, so a feature update will remove them all. A ~300MB restore point is typical of the system-created restore point for your first cumulative update after a feature update.

The Feature Update 1903 was installed 2 weeks ago on August 29. And yes, as I had expected SR was disabled and all RP's gone. But that was as I expected after feature update. I re-enabled SR and began manually creating points daily as well as before/after any change I made in system or programs etc.. This had accumulated to 30Gigs after 2 weeks. I reset the space allowed , but only to 20%...which is more than I really needed..
==================

So far, I don't see references to SR point deletions in Event Viewer, But I dont know where in that complex navigation maze there to look for such events?

The system created point last night, was NOT after any WU or feature update. But all other points were deleted. Is 300 Mb's normal for such a system point as well?

Vaguely recall that a few SR points go to several gigs in general..

eliuri said:

The Feature Update 1903 was installed 2 weeks ago on August 29. And yes, as I had expected SR was disabled and all RP's gone....

Experiences vary. Some report that System Protection is turned off by each Feature Update, others (myself included) find that it remains enabled.

The system created point last night, was NOT after any WU or feature update. But all other points were deleted. Is 300 Mb's normal for such a system point as well?
Vaguely recall that a few SR points go to several gigs in general..

TBH, I don't rely on system restore any more, it's always been a bit of a gamble whether it would work or not (except in 1803 where it seemed guaranteed to fail). I do leave it turned on though as a last resort, but my main protection is regular system images with Macrium Reflect Free.

To slim down the system image I routinely run Disk Clean up to clean up system files and update backups, then delete all system restore points before making the Macrium image. The last time I did that was yesterday, after the Patch Tuesday update to 1903, build 18362.356.

As a test, I have just made a manual restore point. That was just 27.38MB.

Thanks, Bree for testing that..

For myself, I've found SR always works, but I rarely restore back to more than a day or so...At most 3-4 days. So maybe that's why..

It might be that all those points were deleted because there were so many of them. Though only a small percentage of the allowable space?

I still would like to review System Restore or Volume shadow copy events in Event Viewer to see if there were errors or Eent ID's such as those Zbook referenced above. But I dont know where to navigate to in Event Viewer?

There are log collectors used in another forum room.
One of folders includes the event viewer entries in a form that is easier to search using notepad.
Run V2 and upload the results into this thread:
BSOD - Posting Instructions

Thanks, zbook..

But i have gotten info on SR and Volume Shadow Copy directly from EventViewer in the past without installing anything. So I'd much rather do it that way first. It's just that I've forgotten where in EventViewer SR and Volume Shadow Copy issues are to be found?

eliuri said:

...where in EventViewer SR and Volume Shadow Copy issues are to be found?

Look in Windows Logs > Application