Windows Defender / System Restore Points

Win10 Home x64 (1803-17134.288)

Starting in August 2018 (don't know the exact date) ... Windows Defender / Windows Module Installer are creating a System Restore Point every 24 hrs. Based on the time stamps, it appears this is being done by the default Windows Defender Task (Verification Task) in Task Scheduler. As part of this, the Component Based Servicing is creating xxx_xxxx.xml and xxx_xxx.bak.xml file in the C:\Windows\servicing\Sessions folder.

The CBS.log shows the following ...

2018-08-16 02:57:28, Info CBS Exec: Processing started. Client: DISM Package Manager Provider, Session: 30684462_1698231930, Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.17134.1, Identifier: Windows Foundation 2018-08-16 02:57:28, Info CBS Exec: Using execution sequence: 92 2018-08-16 02:57:28, Info CBS Reboot mark set 2018-08-16 02:57:28, Info CBS Winlogon: Registering for CreateSession notifications 2018-08-16 02:57:28, Info CBS Winlogon: Loading SysNotify DLL 2018-08-16 02:57:28, Info CBS Winlogon: Starting notify server 2018-08-16 02:57:28, Info CBS Disabling LKG boot option 2018-08-16 02:57:28, Info CBS Exec: Creating restore point: Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.17134.1, current: Installed, targeted: Installed 2018-08-16 02:57:28, Info CBS Restore point type: Install 2018-08-16 02:57:28, Info CBS Perf: Begin: nested restore point - begin 2018-08-16 02:57:33, Info CBS Perf: Begin: nested restore point - complete

I do not want/need Windows Defender filling up my System Restore Allocated Size with these Restore Points ... How do you stop this from happening without turning off System Restore Points ???

Moved from: Windows /  Windows 10  / Security & privacy

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Same here, and we're not the only ones!

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Same here and I spoke today with a Microsoft rep who just removed the Windows Modules Installer points and created a manual restore point which promptly disappeared after signing out of the remote access.  I was NOT pleased with Microsoft in how they handled this case as I told her that it was not only me who has this problem because I saw these entries in CCleaner.  She told me NOT to use CCleaner (as if the problem then would go away!!)  Must be many thousands if not more who have the very same problem and are not aware of it.  I became aware of this problem because I use CCleaner and noticed all those darn daily entries as of Aug 1 2018.  I'm NOT a happy camper.   

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I deleted all these restore points the other day and reclaimed about 16GB of space on the C drive, but every 24 hours another is created. Why?

1 person found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

After yesterdays debacle with Microsoft (when the rep removed all the Windows Modules Installer , created a restore point which disappeared after the call) and I created a new restore point yesterday, today again I have the Windows Modules Installer shown again in CCleaner. So in effect, she didn't do anything other than removing the WM Installers. Darn Microsoft!   You didn't fix anything!!

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

After yesterdays debacle with Microsoft (when the rep removed all the Windows Modules Installer , created a restore point which disappeared after the call) and I created a new restore point yesterday, today again I have the Windows Modules Installer shown again in CCleaner. So in effect, she didn't do anything other than removing the WM installers. Darn Microsoft!

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Anyone from Microsoft care to comment on this?

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Anyone from Microsoft care to comment on this?

Crickets!!  They don't seem to care!

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I have the same problem, where everyday, a new restore point is created called "Windows Modules Installer".  The type of restore point is called "Application Install".  I have not installed any applications.  This has been going on for at least a week, everyday.

Also, I cannot turn on Automatic Updates - the slider just pops back off - and so I have to check for updates manually each day. When it updates, this, in itself, does not create a restore point.

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

This is what I read on this website:https://www.askwoody.com/forums/topic/system-restore-100-greyed-out/

as per Woody:  "Microsoft is phasing out Restore Points, in favor of doing a system refresh."

If that is true there will be an uproar coming! 

4 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

We've been hearing that MS is going to do away with System Restore for awhile now, which makes this change where Windows Defender (Verification Task) / Windows Module Installer creating daily Restore Points even more puzzling. This same change is also in Windows 10 Insider Preview Build 17746 (RS5), so it would it appear that System Restore isn't going away in the near future, but of course I could be wrong. Guess we'll find out in next months WD Platform Update if this was just an ooops or not.

Note:

1. It appears that disabling the Windows Defender Verification Task in Task Scheduler will stop the daily Restore Points from being created.

2. No guarantee it won't get enabled again on the next run or next WD Platform Update.

3. Don't know what (if any) side effects might occur if you disable it ... so disable it at your own risk.

13 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
 

Question Info


Last updated August 4, 2022 Views 3,316 Applies to: