Windows 11 is quietly getting something users have wanted for years: a way to reliably roll a broken PC back to a known‑good state, or wipe and rebuild it without touching the hardware.
Two new capabilities sit at the center of this push: Point‑in‑Time Restore and Cloud Rebuild. They build on the existing Windows Recovery Environment (WinRE), Quick Machine Recovery, and Intune management to make modern PCs less fragile when updates, drivers, or misconfigurations go wrong.
What Point‑in‑Time Restore does on Windows 11
Point‑in‑Time Restore (often shortened to PITR) is a new recovery action that can roll a Windows 11 PC back to an earlier, healthy snapshot within minutes. Unlike the older System Restore feature, these snapshots are designed to be complete system points, not just OS files.
A Point‑in‑Time Restore rollback reverts:
- Windows itself (system files and updates)
- Installed applications
- System and app settings, including configuration changes
- Local user files on the device
That scope is intentional. The goal is simple: if an update, driver conflict, or configuration tweak knocks a machine offline or makes it unstable, you can move the entire device back to a state from before the problem started, without hunting for the root cause.
Point‑in‑Time Restore vs System Restore
System Restore has been around for years, but it’s limited and increasingly unreliable. Point‑in‑Time Restore uses the same underlying Volume Shadow Copy Service (VSS) technology to capture snapshots, but it changes how they’re created, what they store, and how they’re managed.
| Aspect | Point‑in‑Time Restore | System Restore |
|---|---|---|
| What gets captured | OS, apps, settings, configurations, and local user files | Primarily system files and settings; user files excluded |
| How restore points are created | Automatic, on a configurable schedule (short cadence) | Manual creation or event‑triggered (like some installs) |
| Retention | Strict limits; restore points kept for up to 72 hours then removed | No built‑in retention limit; points linger until disk pressure forces cleanup |
| Storage impact | Designed to keep disk usage bounded (configurable percentage) | Can quietly consume significant disk space over time |
| Management experience | Integrated into Windows 11 System > Recovery and built for remote management | Exposed mainly through the classic Control Panel interface |
On Windows 11, Point‑in‑Time Restore is exposed as a first‑class setting in the System > Recovery page, while System Restore remains an older, Control Panel‑era feature. Over time, PITR is positioned to be the primary rollback option on modern devices.
How Point‑in‑Time Restore behaves on Windows clients
On physical Windows 11 PCs, Point‑in‑Time Restore stores its snapshots locally and enforces tight limits to keep them predictable:
- Restore point frequency: by default, a snapshot is taken every 24 hours, with options for shorter intervals such as 4, 6, 12, or 16 hours.
- Retention window: restore points are kept for a maximum of 72 hours and are automatically deleted after that.
- Disk usage cap: PITR is capped by a configurable percentage of disk space (default around 2% of total disk, with a minimum of 2GB and a maximum set in gigabytes).
- Disk pressure: when space gets tight, the oldest restore points are removed first.
There are some important caveats:
- To successfully roll back, the PC must have at least as much free space as the combined size of all restore points on the system.
- A rollback is not guaranteed to result in a bootable or fully healthy system; some bad states or low‑level updates can still break things in ways a snapshot cannot safely unwind.
- Everything on the system reverts to the snapshot time — that includes local documents, passwords, secrets, certificates, and keys created afterward.
Data stored in cloud services such as OneDrive is not affected by PITR, which helps soften the impact of that broad rollback.
How Point‑in‑Time Restore differs from Windows 365 restore
Windows 365 Cloud PCs already have a Point‑in‑Time Restore concept, but the implementation is tailored to the cloud, not local disks. The goals are the same — quick recovery from failures, bad updates, or user mistakes — but the trade‑offs are different.
| Characteristic | Windows 11 client (local) | Windows 365 Cloud PC |
|---|---|---|
| Feature status | Can be enabled or disabled per device | Always on for eligible Cloud PCs |
| Restore point retention | Up to 72 hours | Up to about a month, with short‑term and long‑term options |
| Restore point types | Short‑term, automatically created | Short‑term, long‑term, and manual restore points |
| Where snapshots live | On the physical disk of the PC | In scalable cloud storage shared across Windows 365 and Azure |
| Expected restore speed | Typically faster; restore point is local | Network and backend load can influence how fast restores complete |
The Windows 11 client implementation focuses on tight, short‑term protection around recent changes, keeping disk impact predictable while still offering quick rollback windows.
Where Point‑in‑Time Restore lives and who can control it
On supported Windows 11 devices (24H2 and 25H2), Point‑in‑Time Restore is integrated into the standard settings experience:
- Users can see the feature and view configuration options.
- Only administrators can change those settings, including turning the feature on or off, setting snapshot cadence, and disk usage caps.
During the initial preview phase, PITR is tested with Windows Insiders in the Dev and Beta channels. For now, users initiate restores while the PC is in the Windows Recovery Environment; triggering a restore remotely from a full Windows session comes later as part of broader management integration.
On larger fleets, PITR is designed to be driven from management tools like Microsoft Intune. That integration will allow admins to:
- Target individual devices or groups for rollback actions.
- Coordinate recovery during a bad update or driver rollout.
- Standardize PITR configuration across an organization.
Cloud Rebuild: a clean slate from the cloud
While Point‑in‑Time Restore focuses on rolling back recent changes, Cloud Rebuild is geared toward machines that need a fresh start. It is a remote‑first way to completely reinstall Windows 11 from clean media, without shipping hardware or visiting a desk.
The flow is centered around Microsoft Intune and WinRE:
- An admin selects the affected device in Intune and chooses Cloud Rebuild.
- They pick the Windows release and language for the reinstall.
- The PC uses WinRE to download the appropriate installation media from the cloud.
- Windows is reinstalled and then hands off to the normal out‑of‑box experience.
From there, the modern provisioning stack takes over:
- Windows Autopilot re‑enrolls the device in the correct management (MDM) environment and reapplies policies.
- Intune, Windows Backup for Organizations, and OneDrive for Business bring back apps, settings, and user data where configured.
The goal is to shrink what used to be hours or days of manual re‑imaging into a largely unattended process, driven from a single management console.
Cloud Rebuild is in preview for Windows 11 and is planned to be generally available for commercial customers in the first half of 2026.
How Quick Machine Recovery fits into the picture
Point‑in‑Time Restore and Cloud Rebuild are only part of the broader recovery story. Quick Machine Recovery (QMR) is already available on Windows 11 and handles a different, but related, scenario: when machines won’t boot at all.
QMR runs from the Windows Recovery Environment and does three main things:
- Detects and diagnoses boot‑critical failures, such as bad drivers, updates, or configuration changes that prevent startup.
- Uploads crash and configuration information to Microsoft for automated analysis.
- Applies targeted fixes — for example, removing a specific driver or undoing a configuration change — and then attempts to boot again.
Recent improvements focus on:
- Running a single, comprehensive scan rather than looping through repeated attempts.
- Exposing QMR configuration in Windows settings and enabling it by default on many Windows Home devices.
- Letting Autopatch manage QMR updates on managed Pro and Enterprise PCs, so IT can control rollout, approvals, and reporting.
QMR and Point‑in‑Time Restore complement each other: QMR tries quick, targeted repairs when a machine can’t boot; PITR offers a broader rollback when the system is unstable or repeatedly failing; Cloud Rebuild is the nuclear option when nothing else sticks.
Networking and Intune recovery inside WinRE
All of these capabilities lean on the Windows Recovery Environment, which historically has been isolated and hard to manage at scale. That is changing in two important ways.
Built‑in networking in WinRE
WinRE has long supported networking, but only if admins manually injected network drivers or used specific commands. Windows 11 is moving to a simpler model:
- WinRE can now pull the network driver directly from the main Windows installation.
- Ethernet networking is the first focus; support for Wi‑Fi using WPA2/WPA3 and enterprise certificates will follow.
That matters for features like Cloud Rebuild and QMR, which both rely on the recovery environment reaching services on the internet or in the organization’s network.
Intune recovery as a management plane for WinRE
Remote recovery in Intune turns WinRE into something admins can see and control:
- When a managed PC enters WinRE, Intune can show its recovery state in the console.
- Admins can run custom recovery scripts or trigger built‑in actions like Point‑in‑Time Restore or Cloud Rebuild remotely.
- The same plug‑in model is being extended to Windows Server virtual machines through the Azure portal.
Over time, that means the Windows Recovery Environment stops being a black box and becomes another manageable state in the device lifecycle.
Where these tools leave Windows 11 recovery
The CrowdStrike outage in 2024, which left millions of Windows machines unable to boot, put recovery weaknesses in stark relief. The newer lineup — Quick Machine Recovery, Point‑in‑Time Restore, Cloud Rebuild, WinRE networking, and Intune recovery — is Microsoft’s answer to that moment.
On a single PC, the practical impact looks like this:
- If a configuration change or driver breaks boot, QMR tries an automated repair from WinRE.
- If an update or driver introduces more subtle instability, PITR can rewind the entire system to a snapshot from before the change.
- If the device is behaving erratically and nothing else works, Cloud Rebuild lets IT remotely flatten and reinstall Windows 11 from clean media, then bring back apps and data.
None of these options replace basic hygiene like backups, good change control, and tested update rings. But they do shift Windows 11 closer to a state where serious failures are recoverable in a controlled, repeatable way — often without someone physically touching the machine.
