Jump to content

How to fetch date/time of last windows 10 system restore point?

Recommended Posts

The are numerous ways to get the information.  Here are a few:

  • Capture & Parse a command line command:
    • ShadowCopy Object (Timestamp is slightly different by a few seconds but value is local time)
      • vssadmin list shadows (CMD)
      • wmic ShadowCopy get InstallDate (CMD)
    • SystemRestore Object (Timestamp is UTC and has to be converted to local time)
      • wmic /namespace:\\root\default path SystemRestore get CreationTime (CMD)
      • Get-ComputerRestorePoint (PowerShell)
  • AutoIt WMI query


Example of command capture and WMI query below:

#RequireAdmin ;System Restore point access requires elevated privileges

#include <Constants.au3>
#include <Array.au3>
#include <Date.au3>


Func last_restore_point_wmi_example()
    Local $oWmi, $oItems, $oComError
    Local $sRestorePointDateTime = ""
    Local $aRestorePoints[0]

    #forceref $oComError

    $oComError = ObjEvent("AutoIt.Error", comm_error_handler)

    ;Get WMI object
    $oWmi = ObjGet("winmgmts:\root\default")

    ;Query restore points
    $oItems = $oWmi.ExecQuery("SELECT CreationTime FROM SystemRestore")
    If $oItems.Count = 0 Then Exit MsgBox($MB_ICONWARNING,"Warning","No items found")

    ;Process result set
    For $oItem in $oItems
        With $oItem
            ;Convert UTC creation time from yyyymmddhhmmss to local yyyy-mm-dd hh:mm:ss time
            $sRestorePointDateTime = convert_utc_to_local_time(.CreationTime)

            ;Add date/time to the array
            _ArrayAdd($aRestorePoints, $sRestorePointDateTime)

    ;Sort the array in descending order and display first entry
    _ArraySort($aRestorePoints, 1)
    MsgBox($MB_ICONINFORMATION, "WMI Example", "Last System Restore Point" & @CRLF & $aRestorePoints[0])

Func last_restore_point_cmd_example()
    Local $iPID = 0
    Local $sCmdOutput = ""
    Local $aRestorePoints[0]

    ;Execute & capture console command output
    $iPID = Run("wmic /namespace:\\root\default path SystemRestore get creationtime /format:list", "", Default, $STDERR_MERGED)
    If Not $iPID Then Exit MsgBox($MB_ICONERROR, "ERROR", "WMIC command failed.")

    ;Wait for command to finish
    If Not ProcessWaitClose($iPID, 5) Then Exit MsgBox($MB_ICONERROR, "ERROR", "Timeout occurred waiting for command to complete.")

    ;Get command output and parse info of interest
    $sCmdOutput = StdoutRead($iPID)

    $aRestorePoints = StringRegExp($sCmdOutput, "(?m)^CreationTime=(\d{14})", $STR_REGEXPARRAYGLOBALMATCH)
    Switch @error
        Case 1
            MsgBox($MB_ICONWARNING,"Warning","No items found")
        Case 2
            MsgBox($MB_ICONERROR, "ERROR", "Stringregexp error. @error = " & @error)
            Exit 1

    ;Process result set
    For $i = 0 To UBound($aRestorePoints) - 1
        ;Convert utc creation time from yyyymmddhhmmss to local yyyy-mm-dd hh:mm:ss
        $aRestorePoints[$i] =  convert_utc_to_local_time($aRestorePoints[$i])

    ;Sort the array in descending order and display first entry
    _ArraySort($aRestorePoints, 1)
    MsgBox($MB_ICONINFORMATION, "WMIC Example", "Last System Restore Point" & @CRLF & $aRestorePoints[0])

Func convert_utc_to_local_time($sUTCDateTime)
    Local $tSYSTEMTIME = DllStructCreate($tagSYSTEMTIME)

    ;Convert utc time to local time
    $tSYSTEMTIME.Year   = StringMid($sUTCDateTime,  1, 4)
    $tSYSTEMTIME.Month  = StringMid($sUTCDateTime,  5, 2)
    $tSYSTEMTIME.Day    = StringMid($sUTCDateTime,  7, 2)
    $tSYSTEMTIME.Hour   = StringMid($sUTCDateTime,  9, 2)
    $tSYSTEMTIME.Minute = StringMid($sUTCDateTime, 11, 2)
    $tSYSTEMTIME.Second = StringMid($sUTCDateTime, 13, 2)

    $tSYSTEMTIME        = _Date_Time_SystemTimeToTzSpecificLocalTime($tSYSTEMTIME)

    Return StringFormat("%04i-%02i-%02i %02i:%02i:%02i", _
                        $tSYSTEMTIME.Year, $tSYSTEMTIME.Month , $tSYSTEMTIME.Day, _
                        $tSYSTEMTIME.Hour, $tSYSTEMTIME.Minute, $tSYSTEMTIME.Second)


Func comm_error_handler($oComError)
    With $oComError
        MsgBox($MB_ICONERROR, "COM ERROR", _
               "An error occured on line " & .ScriptLine & @CRLF & @CRLF & _
               StringStripWS(.WinDescription, $STR_STRIPTRAILING) & @CRLF & @CRLF & _
               StringFormat("Error Number = %i (0x%x)", .Number, .Number) & @CRLF & @CRLF & _

    Exit 1



Edited by TheXman
Reformat reply & changed example WMI objects from ShadowCopy to SystemRestore
Link to post
Share on other sites

@TheXman Thanks for your kind reply. I just added command " last_restore_point_cmd_example()" at last of script to call the function. But I am facing one issue:

1. Windows is prompting to a question "Allow changes using autoit". I dont want this prompt to happen.


Kindly guide me.

Edited by Jahar
Link to post
Share on other sites

@TheXman Currently I am getting the last restore point with your code.  But if i remove line "#RequireAdmin" , I am getting different result:

1.  For last_restore_point_cmd_example - It says no items are found. But, with #RequireAdmin, it gives restore point

2. For last_restore_point_wmi_example - Msg "An error occured on line 24" is shown.

Please guide me.

Link to post
Share on other sites
32 minutes ago, Jahar said:

For last_restore_point_cmd_example - It says no items are found. But, with #RequireAdmin, it gives restore point

If you get results with #RequireAdmin, and don't get results without it, what does that tell you?  Did you read the first line of my example script?  To query the Restore Points, it requires the script to run with elevated (Admin) privileges.  :bonk:

32 minutes ago, Jahar said:

For last_restore_point_wmi_example - Msg "An error occured on line 24" is shown.

How am I supposed to know why you get errors in your script without seeing your script?  I'm not going to try to guess what is on or around line 24.  If you are referring to the example script, then you probably ran it without #RequireAdmin.


I provided examples for you to learn from.  That means you need to take the time to see and understand what it is doing.  If you make changes to my examples, which I encourage you to do, you need to see how your changes affect the result and why?  It is time for you to do a little learning.  If you don't want to take the time to learn, then hopefully someone else will come along and write your solution for you.  :bye:

Edited by TheXman
Link to post
Share on other sites
34 minutes ago, Jahar said:

is there a way to disable UAC for this script alone?

If you, or the user context in which you are running the script, is an Admin and you are just trying to get rid of the UAC prompt that #RequireAdmin displays, then the following UDF has functions to do it.  However, you will need #RequireAdmin to execute those necessary functions.  That means, until you have made the changes necessary, you will still see the prompt.  So I guess the answer to your question is yes and no.

There are other ways to get around the UAC prompt, without #RequireAdmin, when admin is required.  Discussion of getting around security is discouraged in these forums.  However, there are a few topics that have been created in the past that discuss ways that it can be done.  Some are acceptable to discuss like using the Task Scheduler and others aren't, like self-elevation techniques -- at least is was still taboo the last time I checked.  You will need to search the forum on your own for more information.


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By WilliamasKumeliukas
      2021.07.15 News: Project is NOT dead! I am still very devoted into accomplishing this project, I am spending my every bit of energy that is left at end of the day (when there is any) for this project and it really does challenge my knowledge in AutoIt language but I won't give up  
      I started this project alone in May 2020 as project in my spare time at work, I'm working for a IT company that started opening their services to residential customers few months ago and now my position in the company kind of drifted in the doom and gloom world of repetitive tasks like: Reinstallation + Configuration of Windows 10.
      The procedure is very repetitive and I started feeling like being a robot which is the main reason I started this project.
      1. Q: Do you want this project to be accomplished with the usage of AutoIt ONLY or 3rd party tools / Scripts (BATCH / POWERSHELL / VB) ? A: No, if I cannot find a way using AutoIt to accomplish a task I will move to my Plan B which consist of automating an 3rd party tool to accomplish the affected task until a solution is found. 2. Q: What do I get from helping/collaborating in this project? A: I will personally take the responsibility to mention you in the credits of this project. 3. Q: If I have more questions, can I ask? A: Certainly! feel free to ask any questions related to this project! 4. Q: What is the main goal of this project? A: Automating Windows 10 configuration without user interaction needed (as much as possible) ______________________________________________________________________________________________________________________________
      Current progression of the project (more will be added in future)
      « Blue = Info || Yellow = Unfinished/Untested || Purple = Could be better || Green = Done ||Red = Not Yet Started »
      ***Very early Stage ***
      Connect Network Attached Storage(NAS) (Work but missing configuration in GUI - AutoIt only)
      Download & Install up to 600+ softwares (Tested & Working - using 3rd party tool + 50/50 Powershell/AutoIt)
       Auto prediction of Apps name of text typed inside input (Tested & Working - AutoIt Only)
      Change OEM Informations (Tested & Working -  AutoIt)
      Disable hibernation (Tested & Working - AutoIt only)
      Change Computer Name (Work but require testing - AutoIt only) 
      Show Computer Information and Smart status on GUI (Tested & Working - AutoIt Only)
      Change .pdf / .pdfxml from Edge to Adobe Reader DC (Tested & Working - using 3rd party tool)
      Change Edge to Google Chrome as Default Browser (Tested & Working - using 3rd party tool)
      Windows Updater (Seems to work but require further testing - AutoIt only)
      Install Office 365 / 2013 + Activation (To Do)
      Add L2TP VPN Configuration in Windows Built-in VPN (To Do)
      Save / Load tasks configuration profile in (.ini file) to avoid repeating same configuration twice (In progress - AutoIt Only)
      (EXPERIMENTAL) Install Apps from Microsoft Store with UIAutomation UDF made by: @junkew(Work if you know what your doing)
         P.S: Installing Apps from Microsoft Store will require usage of  UIA spy tool made by @LarsJ which you can download & learn how to use it on UIA Spy Tool thread.
      ***  If this project interest you, Reply here This will greatly help me to see if you'd like this project to become real  ***
      Download: W10-Configurator.zip  (2021-07-19) 
      Project Website: W10-Configurator on GitHub 
      Best Regards,
    • By beautifulsoup
      Hi All,
      I'm not sure if its possible that I'm trying to achieve, I've looked into https://www.autoitscript.com/autoit3/scite/docs/SciTE4AutoIt3/AutoIt3Wrapper.html and such resources for help, but I cant really find the answer to my question.
      So upon compiling the script in SciTE, the exe file is given a Description under file Properties>Details. I understand, that  one can enter info manually there and it can even implement the version automatically with each compilation.
      What I'm trying to achieve is to somehow include the "@ScriptName" in the Details>File Description Field. But as I see no variable can be taken after "#" in this case.
      Do You think its achievable? (Win 10)
      Much obliged for taking time on reading this.
      Kind Regards,

    • By IndianSage
      I have a specific situation:
      Is it possible to run autoit script/.exe as a task which in turn is automating a desktop user interactive application on windows 10 where user will not be logged in - at best I can get user locked? 
      If so how will this work or is there any tool available to do this?
      I am trying z-cron task scheduler but it runs only some part also I tried windows 10 task schedule with option to allow task to run which is user interactive type but that too does not work.
      Looking forward to hear from you to help me out of this situation.
    • By therks
      So I have no example code currently because I'm not sure where to even start.
      We're using the parental controls on the computer and the kids each have their own user profiles with limited time. The problem we're encountering is when their time runs out, or if they just hit Win+L and leave the computer, their games are still running in the background. I was hoping to write up a quick AutoIt script and throw it in a recurring scheduled task to just sign off any of the kid's profiles that's not currently active. I found some suggestions to use "query session" and then "logoff [user]" in the command line (which it seems I could easily automate with AutoIt) but that's only available on Win Pro and this system is running Home (and I even tried copying the query.exe from a Pro system but it errors out). Is there some AutoIt equivalent to the query and logoff functions or am I stuck?
      Edit: I'm adding some clarification to exactly what I'm hoping to get out of this script.
      I'd like to setup a scheduled task that runs outside of the current user (perhaps under the SYSTEM account?) in case NO user is currently active, that will detect which users are currently signed in. If users from a predefined list are not currently active, sign them off entirely.
      So let me give two examples:
      Example #1:
      - I am logged in, but not active (I left my browser open and locked the computer) - Nephew A is logged in, but not active (his time ran out while his game was running and the computer auto-locked) - Nephew B is logged in, and currently playing a game When script runs, ignore my profile (leave it signed in), log out Nephew A (closing his game), and ignore Nephew B because he's actively using the computer. Example #2:
      - I am logged in - Nephew A is logged in - Nephew B is logged in - No users are currently active (Windows is sitting on the choose user / sign in screen) When script runs, ignore my profile, log out Nephew A and Nephew B.  
      I would perceive pseudo code, going as such:
      $aChildUsers = [ 'NephewA', 'NephewB' ] $aUserList = GetSignedInUsers() For $i = 0 to UBound($aUserList)-1 If Not UserIsActive($aUserList[$i]) Then For $j = 0 to UBound($aChildUsers)-1 If $aUserList[$i] = $aChildUsers[$j] Then LogOffUser($aUserList[$i]) Next EndIf Next Obviously, GetSignedInUsers(), UserIsActive(), LogOffUser() are not real functions. What I'm searching for is something of their equivalent.
      Thanks for your time!
    • By paw
      I use SetSoundDevice to control my audio devices but the UI was either
      blurry like this:
      or unusable like this:

      so I made this horrible thing to add scaling to the GUI:
      #Region ;**** Directives created by AutoIt3Wrapper_GUI **** #AutoIt3Wrapper_Change2CUI=y #AutoIt3Wrapper_Res_HiDpi=y #AutoIt3Wrapper_AU3Check_Parameters=-w 3 -w 4 -w 5 #AutoIt3Wrapper_Run_Au3Stripper=y #Au3Stripper_Parameters=/sf /sv /rm #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI **** #include <File.au3> ;~ _convertGUI("") If $CmdLine[0] <> 0 Then _convertGUI($CmdLine[1]) Func _convertGUI($sFilePath) If $sFilePath <> "" Then Local $aArray = FileReadToArray($sFilePath) Else ;TEST DATA Local $aArray[6] = ['$H_Res_Language = GUICtrlCreateProgress(5, 120, 210 + 25, 480, 20, BitOR($GUI_SS_DEFAULT_COMBO, $CBS_SIMPLE)) ; $CBS_DROPDOWNLIST)', _ 'Local $h_Ok = GUICtrlCreateButton("Ok", 72, 224, 81, 33, 0)', _ 'GUICreate($Warning_TiTle, 700, 310, -1, -1, $WS_SIZEBOX + $WS_SYSMENU + $WS_MINIMIZEBOX)', _ 'GUICtrlCreateLabel("Output type: ", 30, 130, 65, 20) ;, $SS_RIGHT)', _ '$H_FieldNameEdit = GUICtrlCreateEdit($INP_FieldNameEdit, 100,260+25, 500, 150 - 25) ;comment', 'Local $H_CANCEL = GUICtrlCreateGraphic("Cancel", 224, 224, 97, 33, 0)'] EndIf Local $hTimer = TimerInit(), $iGUIElementCount = 0, $sResult = "", $sFileName = "", $sDrive = "", $sDir = "", $sExtension = "" If @Compiled Then _PathSplit($sFilePath, $sDrive, $sDir, $sFileName, $sExtension) $sFileName = StringRegExpReplace($sFilePath, "^.*\\", "") EndIf For $i = 0 To (UBound($aArray) - 1) If StringRegExp($aArray[$i], "GUICtrlCreate|GUICreate") Then $sResult = _splitComma($aArray[$i]) If Not @error Then $aArray[$i] = $sResult $iGUIElementCount += 1 EndIf Next ConsoleWrite("t = " & TimerDiff($hTimer) & " GUI elements = " & $iGUIElementCount & " lines = " & (UBound($aArray) - 1) & @CRLF) If $sFileName <> "" Then Local $hFile = FileOpen("edited." & $sFileName, 2) _FileWriteFromArray("edited." & $sFileName, $aArray) FileClose($hFile) EndIf Exit EndFunc ;==>_convertGUI Func _splitComma($sString) Local $sSplitResult = "", $sTrimmedR = "", $sTrimmedL = "" Local $aSplit = StringSplit($sString, ',') If Not @error Then $sTrimmedR = "" $sTrimmedL = "" For $j = 1 To $aSplit[0] If StringRegExp($aSplit[1], "(?:.GUICtrlCreateGraphic|GUICtrlCreateProgress|GUICtrlCreateSlider|GUICtrlCreateTab|GUICtrlCreateTreeView)") Then If $j = 1 Then While StringLeft($aSplit[$j], 1) <> '(' $sTrimmedL &= StringLeft($aSplit[$j], 1) $aSplit[$j] = StringTrimLeft($aSplit[$j], 1) WEnd $aSplit[$j] = StringTrimLeft($aSplit[$j], 1) EndIf EndIf If $j = $aSplit[0] Then While StringRight($aSplit[$j], 1) <> ')' $sTrimmedR &= StringRight($aSplit[$j], 1) $aSplit[$j] = StringTrimRight($aSplit[$j], 1) WEnd $aSplit[$j] = StringTrimRight($aSplit[$j], 1) EndIf If StringRegExp($aSplit[$j], "[0-9]") And $aSplit[$j] <> -1 And $aSplit[$j] <> 0 And $aSplit[$j] <> 1 And Not StringInStr($aSplit[$j], ')') Then If StringRegExp($aSplit[$j], "\-|\+") Then ;put parenthesis around + or - $aSplit[$j] = '(' & $aSplit[$j] & ")*$g_DPI" Else $aSplit[$j] = $aSplit[$j] & "*$g_DPI" EndIf EndIf If $j < $aSplit[0] Then $sSplitResult &= $aSplit[$j] & ',' ElseIf $j = $aSplit[0] Then $sSplitResult &= $aSplit[$j] & ')' Else $sSplitResult &= $aSplit[$j] EndIf Next If $sTrimmedR <> "" Then $sSplitResult &= StringReverse($sTrimmedR) If $sTrimmedL <> "" Then $sSplitResult = $sTrimmedL & '(' & $sSplitResult Else SetError(1) Return EndIf ConsoleWrite($sSplitResult & @CRLF) Return $sSplitResult EndFunc ;==>_splitComma
      And now it looks good: 
      but it doesn't work on everything, for example the "GUICtrlCreateLabel("Output type: ", 30, 130, 65, 20) ;, $SS_RIGHT)" (from the autoit3wrapper gui)
      because the comment contains a parenthesis and it would break completely if there were variables as parameters..
      Is there some kind of parser around that I could use instead or maybe someone who has already done something like this?
  • Create New...