Quick answer: “You must enable system protection on this drive” means System Restore is turned off for the drive you picked, usually C:. In Windows, press Win + R, type SystemPropertiesProtection, select the drive, click Configure, choose Turn on system protection and click OK. If you see the message in the recovery environment instead, Windows may simply be using a different drive letter there; run rstrui.exe /offline:C:\windows=active from the recovery Command Prompt (with the right letter) to reach your existing restore points.
Applies to: Windows 11 and Windows 10. You need an administrator account.
In this guide
Why the message appears
- Protection is off for that drive. Windows 11 often ships with System Restore turned off, and some updates, disk tools or “cleaner” apps turn it off to save space.
- A policy blocks it. On work PCs, Group Policy can disable System Restore or its settings.
- You’re in the recovery environment. In WinRE the Windows drive often gets a different letter (such as D:), so System Restore looks at the wrong drive and shows this message even though restore points exist.
Important: if protection really was off, there are no restore points to go back to. Turning it on now protects you from here on, but it can’t bring back points that were never created.
Turn on system protection in Windows
- Press Win + R, type
SystemPropertiesProtectionand press Enter. (Or search for Create a restore point in Start.) - On the System Protection tab, select your Windows drive, usually Local Disk (C:) (System), and click Configure.
- Select Turn on system protection.
- Move Max Usage to about 5 to 10% of the drive. Too little space and old restore points get deleted quickly.
- Click Apply and OK.
Prefer the command line? In an admin PowerShell window, Enable-ComputerRestore -Drive "C:\" does the same for C:.
If the setting is greyed out
A greyed-out Configure button or a note that the setting is managed by your administrator means a policy is in place. On a work PC, ask IT. On your own PC, open the Local Group Policy Editor (gpedit.msc, Pro and higher editions) and go to:
Computer Configuration > Administrative Templates > System > System Restore
Set both Turn off System Restore and Turn off Configuration to Not Configured, then run gpupdate /force. On Home editions, these policies live in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore; if that key has DisableSR or DisableConfig set to 1, a tweaking tool probably added it. Back up the key, delete those two values and restart. For managing policy on domain PCs, see the Group Policy Management Console.
Check the Volume Shadow Copy service
Restore points are built on shadow copies. Open services.msc and make sure Volume Shadow Copy and Microsoft Software Shadow Copy Provider aren’t set to Disabled; Manual is normal. If creating a restore point fails with a shadow copy error, also run sfc /scannow; if SFC itself fails, see “Windows Resource Protection could not perform the requested operation”.
If you see it in the recovery environment
- In the recovery environment, open Troubleshoot > Advanced options > Command Prompt.
- Find the Windows drive: run
dir C:\Windows, thendir D:\Windowsand so on until you see the Windows folder. - Run
rstrui.exe /offline:D:\windows=active, replacing D: with the letter you found. - System Restore opens for that installation. Pick a restore point and follow the wizard.
If no restore points are listed, protection was off before the problem started. Your options are then SFC offline repair, Startup Repair or a reset. If the recovery environment itself won’t start, see reagentc /enable not working.
Create a restore point now
Once protection is on, create a first restore point so you have something to go back to: in the System Protection tab, click Create, type a name and click Create again. Windows also creates points automatically before updates and driver installs.
From PowerShell (admin) you can run Checkpoint-Computer -Description "Manual restore point". Windows allows only one such point every 24 hours by default, so a second attempt the same day may be skipped quietly.
Related guides
- SFC offline: how to run sfc /scannow from recovery
- reagentc /enable not working: how to fix WinRE
- Windows Resource Protection could not perform the requested operation
- Group Policy Management Console on Windows 11
Official sources: for more detail, see Microsoft’s own pages:
Frequently asked questions
Does turning on system protection slow down my PC?
Not noticeably. It uses some disk space (the Max Usage you set) and briefly works in the background when a restore point is created.
Will System Restore delete my files?
No. It rolls back system files, drivers, installed apps and settings, but leaves documents, photos and other personal files alone. Apps installed after the restore point are removed.
Why did Windows turn system protection off?
New Windows 11 installs often have it off, and feature updates, disk cleanup tools or a full drive can turn it off too. Check it after big updates.
Leave a Reply