Recommended Posts

How to install System restore on server 2003

This thread describes how to install system restore on server 2003. It is not a thread for talking about WHY you might want to do this, that belongs to another thread :)

Below i will show how to do this after server 2003 is installed. I haven't tried slipstreaming this, but i imagine it could be done easily. If there's enough interest i might show how to slipstream system restore into server 2003.

Before we begin, you'll need an XP CD. Doesn't matter if it's home or pro. It shouldn't matter if it has a service pack on it, since all the files will be the same source. In testing i used a slipstreamed cd that already had sp1 on it.

In XP, system restore is installed in syssetup.inf under the inf.always section. If you have XP installed, you can open up %windir%\inf\syssetup.inf and search for [infs.Always], you'll see the section xp looks at for installing system components. You'll notice it has sr.inf, this is the inf for system restore. For server 2003, if you look at syssetup.inf you won't find sr.inf. This doesn't mean system restore won't work in server 2003, it just means they didn't install it.

So first what we're going to need to do is right click on sr.inf and select 'install', to install it on server 2003. If you have xp installed on another computer/partition you can just right click on it. If you don't, then extract \i386\sr.in_ from the XP cd to your desktop, then right click on it and select 'install'. It'll prompt you were the files are, point it to the XP CD. Once done, it'll prompt to restart, say yes.

That was easy, the next part is the tricky part. After restarting you'll get an error saying the service couldn't start. Specifically the error is error 1068. I searched google and found this link - http://www.aerdyne.com/Kbase/article_000005.htm. The error basically means it cannot run under the service it's on. In system restore's case, it runs under the network service. I know this because in services.msc, for path to executable, it says this: C:\WINDOWS\system32\svchost.exe -k netsvcs. This got me thinking so i opened up sr.inf, and found this line:

[sRSvc_delreg]

HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SvcHost","SRGroup"

I opened up regedit, and this registry key didn't exist. So it seems the sr.inf doesn't register system restore to run under the network services group. Using the above registry key as an example, i opened regedit and went to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost

On the right hand side i saw netsvcs. I double clicked on it, but saw SRService no where (SRService is the name for system restore). On a hunch, at the bottom i added SRService, rebooted, and this time got no error on startup. I opened up rstrui.exe, and system restore opened fine. I also had a System restore tab in system properties now too. I was able to make a restore point fine, then restore the computer to it without any problems. So in the above key, you want to double click on netsvcs, and at the bottom of the list, you want to type in SRService (probably case sensitive).

If you're not good with the registry you can save the following as a whatever.reg file and import it, but because it's binary i can't say if it'll work. I recommend manually adding SRService to the netsvcs key.

---copy below to whatever.reg then double click on it -----

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

"netsvcs"=hex(7):41,00,70,00,70,00,4d,00,67,00,6d,00,74,00,00,00,41,00,75,00,\

64,00,69,00,6f,00,53,00,72,00,76,00,00,00,42,00,72,00,6f,00,77,00,73,00,65,\

00,72,00,00,00,43,00,72,00,79,00,70,00,74,00,53,00,76,00,63,00,00,00,44,00,\

4d,00,53,00,65,00,72,00,76,00,65,00,72,00,00,00,45,00,76,00,65,00,6e,00,74,\

00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,48,00,69,00,64,00,53,00,65,00,\

72,00,76,00,00,00,49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,\

00,49,00,72,00,6d,00,6f,00,6e,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,\

53,00,65,00,72,00,76,00,65,00,72,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,\

00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,\

4d,00,65,00,73,00,73,00,65,00,6e,00,67,00,65,00,72,00,00,00,4e,00,65,00,74,\

00,6d,00,61,00,6e,00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,\

73,00,76,00,63,00,00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,\

00,61,00,74,00,69,00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,\

67,00,65,00,6e,00,74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,\

00,52,00,61,00,73,00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,\

65,00,61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,61,00,63,00,73,00,76,\

00,72,00,00,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,00,00,53,00,\

65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,53,00,45,00,4e,00,53,00,00,\

00,53,00,68,00,61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,00,73,00,73,00,\

00,00,54,00,68,00,65,00,6d,00,65,00,73,00,00,00,54,00,72,00,6b,00,57,00,6b,\

00,73,00,00,00,54,00,72,00,6b,00,53,00,76,00,72,00,00,00,57,00,33,00,32,00,\

54,00,69,00,6d,00,65,00,00,00,57,00,5a,00,43,00,53,00,56,00,43,00,00,00,57,\

00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,00,00,\

77,00,69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,77,00,75,00,61,00,75,00,73,\

00,65,00,72,00,76,00,00,00,42,00,49,00,54,00,53,00,00,00,53,00,68,00,65,00,\

6c,00,6c,00,48,00,57,00,44,00,65,00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,\

00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,75,00,70,00,6c,00,\

6f,00,61,00,64,00,6d,00,67,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,\

00,53,00,4e,00,00,00,53,00,52,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\

00,00,00,00

--- copy above --------------------------------------------------------

That's it! Remember to restart both times.

Enjoy,

-gosh

post-77-1057441727.jpg

post-77-1057441727.jpg

Ok i just did a bit of editing. You know the system restore icon, looks a bit naff dont it? Kinda looks like Microsoft didnt have time to finnish it.... anyway i personally think the icon from Windows Me looks a lot nicer (i requested this icon it in another thread but its ok i found it now).

Anyway i extracted the icon group from the file, then used resource hacker to integrate the new icons into the original file. I thought id share just incase you want to use it :) just pop it in the \system32\restore\ folder.

rstrui.2k3.zip

rstrui.2k3.zip

Ok i just did a bit of editing. You know the system restore icon, looks a bit naff dont it? Kinda looks like Microsoft didnt have time to finnish it.... anyway i personally think the icon from Windows Me looks a lot nicer (i requested this icon it in another thread but its ok i found it now).

Anyway i extracted the icon group from the file, and i thought id share just incase you want to use it :).

rstrui.2k3.zip

rstrui.2k3.zip

To slipstream you would just need to add the registry key for netsvcs then copy the files for system restore into the i386 folder.

For instance in the hivesft.inf for xp youll see this:

HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost",netsvcs,0x00010000,\

"6to4",\

"AppMgmt",\

"AudioSrv",\

"Browser",\

"CryptSvc",\

"DMServer",\

"DHCP",\

"ERSvc",\

"EventSystem",\

"HidServ",\

"Ias",\

"Iprip",\

"Irmon",\

"LanmanServer",\

"LanmanWorkstation",\

"Messenger", \

"Netman",\

"Nla",\

"Ntmssvc",\

"NWCWorkstation",\

"Nwsapagent",\

"Rasauto",\

"Rasman",\

"Remoteaccess",\

"Schedule",\

"Seclogon",\

"SENS",\

"Sharedaccess",\

"SRService",\

"Tapisrv",\

"TrkWks",\

"W32Time",\

"WZCSVC",\

"Wmi",\

"WmdmPmSp",\

"winmgmt"

In hivesft.inf for server 2003 youll see this:

HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost",netsvcs,0x00010000,\

"AppMgmt",\

"AudioSrv",\

"Browser",\

"CryptSvc",\

"DMServer",\

"EventSystem",\

"HidServ",\

"Ias",\

"Iprip",\

"Irmon",\

"LanmanServer",\

"LanmanWorkstation",\

"Messenger", \

"Netman",\

"Nla",\

"Ntmssvc",\

"NWCWorkstation",\

"Nwsapagent",\

"Rasauto",\

"Rasman",\

"Remoteaccess",\

"Sacsvr",\

"Schedule",\

"Seclogon",\

"SENS",\

"Sharedaccess",\

"TrkWks",\

"TrkSvr",\

"W32Time",\

"WZCSVC",\

"Wmi",\

"WmdmPmSp",\

"winmgmt"

So just edit the server 2003 hivesft.inf file, and add SRService in that list. Then copy the files listed in sr.inf to the 2003 i386 folder. Finally, find some way to run the install. One way you could do this is with an unattend file, and have it run this command:

rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 sr.inf

Just change the path to sr.inf. That's the basic idea! That should work but untested.

-gosh

Well not quite, someone has to still get the welcome screen back up and the little user photo in the start menu. Once we have that, we will all trully have something unique. ;) Even better still if someone could pool all the hacks here (at least this kind) on this forum into an installable .exe conversion pack.

Q

Syntax Error - Microsoft didn't put System Restore on a Server OS because if the end user were to use it ( e.g. due to installing a faulty program .... ), it would cause data replication on the system - which is not good for a server in a production enviroment ....

Radish.

How are we so sure, that doing this, will make System Restore Work as its indented too?

Does it actually create "System Volume Information" in which it really does save the restore points?

or is this just some registry hack to make the application appear to work.

i'm too busy now, but tomorrow i'm planning on doing all this and doing some tests with system restore. then i'll post the results. from just installing the inf file, the tab appears in system properties, and it puts an icon in the start menu, in accessories\system tools. it seems pretty real to me.

Even without system restore you have a system volume information folder. In my original post i put that i was able to make restore points, then restore my computer to that restore point. Your just mad because you said it was "impossible" to do this, and i did it in 5 mins ;p

-gosh

make a list of questions you want me to answer about it tomorrow, i'll try to answer as many of them as possible. dunno about that automatic restore points though, cause that's every 24 hours windows is running, and i'm not using that install of windows nearly as much as xp. :/

Ok, number 1 can you lay out your guide a little more clearly minus superflous points, just action/outcome action/outcome sort of thing. (eg. Go to this directory do this, go to that directory do that, all in list format). Not that I'm sying its hard to follow, just that it could use a little cleaning up. BTW is that reg key all we need? Or is anything else required? If that's so can you post it in .reg format (I know its easy to do with notepad and change the extension, but its nice to just collect all these keys - and as I said, hopefully some day someone will get round to making an installer that will reisntate all these keys and hacks).

Q

Edited by raid517

Gosh.

All i can say is great work, You have been able to do something that has not been able to be done and that has been known as 'impossible' from the likes of myself and others.

Great guide you made there also, nice and thorough and easy to understand.

I appreciate your time in creating that guide.

Thank you so much for this.

Cheers

:D

Sorry I didn't make myself very clear, I've modified my post a little.

Anyway, great work all in all. I don't understand why people are saying its a bad thing though. Data replication in a server may be bad (why though?) but if your using it as a work station, is it still a bad idea?

Q

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Waymo recalls self-driving software after cars enter closed freeway work zones by Paul Hill Waymo, the self-driving car maker owned by Alphabet – the parent company of Google –, has recalled some of its fifth-generation Automated Driving Systems (ADS). It did so after some of its cars drove through closed construction zones. According to the National Highway Traffic Safety Administration (NHTSA), the affected vehicles were capable of driving through a closed freeway construction zone and continuing to drive at speed. The listing on the NHTSA website says that Waymo is currently developing a solution to fix this issue, but in the meantime, freeway driving is being restricted. Waymo will update its ADS software so that vehicles can detect when they can avoid entering construction zones. According to the Safety Recall Report, on April 20, 2026, Waymo’s Field Safety Committee began meetings reviewing an event from April 11, 2026, and five events from April 19, 2026, where Waymo’s autonomous vehicles didn’t recognize and drove past ramp closure signs into the pre-planned freeway construction zones. This took place in Phoenix, Arizona. Separately, on May 18, 2026, seven Waymo vehicles entered freeway lanes with active construction in the San Francisco Bay Area by driving between cones that were placed to show the lane was closed. On the back of both of these events, Waymo restricted freeway driving until it could address the issue. In June, Waymo’s Safety Board reviewed the issue and additional information related to ADS performances around construction zones; then, as a result, it decided to conduct a recall. This development is not good for Waymo as it adds to a growing list of technical hiccups its cars have experienced. Ultimately, it will lead to more scrutiny from lawmakers around the world who will be more cautious about letting autonomous vehicles on their roads without tighter regulation. For readers in areas where Waymo operates, does this news make you more wary about stepping into one of these vehicles?
    • I'm still on Windows 10 22H2 because I didn't want to deal with all the issues in Windows 11, so I waited almost a week before installing the latest Patch Tuesday update (KB5094127), I went ahead and did it, and it was a huge mistake—ever since then, my File Explorer has seen a performance drop of about 30% when transferring large files... Once again, Microsoft has outdone itself! This update cannot be uninstalled, either through the Control Panel (via Settings) or by accessing Advanced Startup Options. The only possible alternative would be to use system restore points, but I’d have to reinstall all app and driver updates (and there’s no guarantee it would work). Or there’s the “nuclear option” of a in-place repair without losing files or apps, but even then, all my customizations would be lost! Microsoft just can’t help but mess everything up! Way to go, Microsoft! But I still don’t want your c****y Windows 11!
    • Microsoft: Windows 11 could finally solve a major issue across AMD, Nvidia, and Intel GPUs by Sayan Sen While Microsoft has been trying to improve it, Windows 11 is definitely not flawless, as even today some issues are taking a year to publicly acknowledge. However, one area of trouble that may finally see much better results soon is graphics driver crashes. Work on graphics driver timeouts, also called Timeout and Detection Recovery (TDR), is not new as the latest WDDM 3.2 also has specific improvements regarding it. Windows Display Driver Model (WDDM) version 3.2 is supported on Windows 11 24H2 and 25H2. However, with the upcoming version 26H2, TDR crash diagnosis could go to the next level as Microsoft is introducing a new DirectX 12 API feature called "DirectX Dump Files". Similar to how system memory dump files work when a system crashes or freezes or encounters any such major issue, DirectX Dump Files (DDF) will essentially record a snapshot of the GPU execution right at the moment a graphics-related crash or hang or freeze occurs, so that developers can better understand and diagnoze these TDR and timeout detection errors. The dump will be available as a .dxdmp file for analysis and it will be a comprehensive dump file generated with detailed insights about the hardware, drivers, Windows, as well as the affected application. This should be another welcome change in this department. Earlier at GDC 2026, when the technology was first debuted, Microsoft had shared more details regarding it. The company had explained how DDF is designed to gather data from every layer of the graphics stack into a single file, eliminating the need for developers to manually correlate logs from multiple tools. As mentioned above, the dump can contain a lot of useful details like GPU hardware state information such as register values, shader program counters, page fault virtual addresses, shader memory data, and command buffers. Alongside that, it also captures DirectX runtime and kernel information, including D3D objects, pipeline state objects, device error data, adapter details, and CPU call stacks. Microsoft says the feature has been built around two primary use cases: retail device removals and local device removals. The former allows developers to collect crash information from end users' systems in the field, while the latter helps QA teams and developers investigate issues on test machines. Developers will also be able to include up to 2 MB of custom application data through new D3D12 APIs, providing additional context for troubleshooting. In addition, Microsoft is introducing three dump collection modes ranging from zero-overhead capture, which has no runtime performance impact on supported hardware, to higher-detail modes that collect more vendor-specific debugging data. On compatible Tier 2 hardware, zero-overhead dumps will be enabled by default, meaning developers may begin receiving useful crash diagnostics without making any code changes. The table below explains the three tiers: Tier Description NO_OVERHEAD Enables crash capture with no runtime cost and is suitable for broad deployment MEDIUM_OVERHEAD Provides a balance, capturing additional diagnostic data with moderate impact HIGH_OVERHEAD Collects the most detailed GPU and driver state available, enabling deeper investigation at the cost of higher runtime overhead In terms of availability, the company expects broader release to be around the fall of 2026, which should be right around the time when Windows 11 version 26H2 lands. Right now, DirectX Dump Files are available as a preview and currently, only AMD has the compatible AgilitySDK Developer Preview driver version 26.10.07.02. You can find the official announcement post here on Microsoft's website.
    • And with SO much better perf than the laggy mess that is Files.
  • Recent Achievements

    • One Month Later
      Sharbel earned a badge
      One Month Later
    • First Post
      BizSAR earned a badge
      First Post
    • Week One Done
      Jordan Smith earned a badge
      Week One Done
    • Reacting Well
      BizSAR earned a badge
      Reacting Well
    • First Post
      AndreaB earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      598
    2. 2
      +Edouard
      190
    3. 3
      PsYcHoKiLLa
      80
    4. 4
      Michael Scrip
      76
    5. 5
      Steven P.
      69
  • Tell a friend

    Love Neowin? Tell a friend!