Hello all,

would anyone know how I can delete all system restore points on drive
C:\  programmatically (preferably in Delphi, but any other programming
language will do also)?


The reason for my asking is, we deploy Windows XP pc's that are installed
from network using a bootable floppy and an unattended installation script.
Some of the scripting tools that we use in the process of this installation
are recognized false-positively as malware by some virus scanners.

Even though the installation directory is deleted on the hard disk after
installation, some of the "offending" executables are still present in
restore points in the \System Volume Information folder and I would very
much like to get rid of them.

I know how to do it by hand, but I would rather have it done in code so
it can be automated.

The easy way would be to grant the installation account full access
on the "\System volume information" folder and simply zap all the files
in it but that method is kinda un-elegant IMHO. I'd rather do it the
"documented" way if you understand my point.






-- 
Arthur Hoornweg

(In order to reply per e-mail, please just remove the ".net"
  from my e-mail address. Leave the rest of the address intact
  including the "antispam" part. I had to take this measure to
  counteract unsollicited mail.)

Mike Collins wrote:
> This is basically how many system works, you must set the relevent registry 
> keys and then stop the system restore service.
> 
> When the service is restarted, it will delete all it's own restoration 
> points...


Ah, so that's it.

I wrote this little VBS:

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\default")
Set objItem = objWMIService.Get("SystemRestore")
errResults = objItem.Disable("C:\")
errResults = objItem.Enable("C:\")


And I wondered why just disabling and subsequent enabling system
restore still left at least one restore point...






-- 
Arthur Hoornweg

(In order to reply per e-mail, please just remove the ".net"
  from my e-mail address. Leave the rest of the address intact
  including the "antispam" part. I had to take this measure to
  counteract unsollicited mail.)

Arthur Hoornweg wrote:
> Hello all,
> 
> would anyone know how I can delete all system restore points on drive
> C:\  programmatically (preferably in Delphi, but any other programming
> language will do also)?
> 
> 
> The reason for my asking is, we deploy Windows XP pc's that are installed
> from network using a bootable floppy and an unattended installation script.
> Some of the scripting tools that we use in the process of this installation
> are recognized false-positively as malware by some virus scanners.
> 
> Even though the installation directory is deleted on the hard disk after
> installation, some of the "offending" executables are still present in
> restore points in the \System Volume Information folder and I would very
> much like to get rid of them.
> 
> I know how to do it by hand, but I would rather have it done in code so
> it can be automated.
> 
> The easy way would be to grant the installation account full access
> on the "\System volume information" folder and simply zap all the files
> in it but that method is kinda un-elegant IMHO. I'd rather do it the
> "documented" way if you understand my point.
> 
> 
> 
> 
> 
> 

If you turn off ssytem restore it will automatically delete all restore 
points. This can be done via Active Directory group policies so you 
could have the Organisational Unit (OU) where your new domain accounts 
get created with an associated group policy to disable system restore. 
If your admin people the move the computer accounts to the another OU 
then system restore could be re-enabled.
Alternatively you could find the registry entry that does this and set 
it in your script - dirty but might work,

Steve

"Arthur Hoornweg" wrote...
> Not really. That function allows to delete a *specific* restore point
> but somehow a function to enumerate them is missing.
> I just want to delete *all* restore points.


You can use WMI for that.  For example:

http://www.online-admin.com/howtozone/system_restore_enumerate.html

-- 
Thanks,
Jon E. Scott
Blue Orb Software
http://www.blueorbsoft.com 

Jon E. Scott wrote:

> I've written code to create restore points, but not delete them.  What you 
> want is this:
> 
> http://msdn2.microsoft.com/en-gb/library/aa378934.aspx

Not really. That function allows to delete a *specific* restore point
but somehow a function to enumerate them is missing.
I just want to delete *all* restore points.




-- 
Arthur Hoornweg

(In order to reply per e-mail, please just remove the ".net"
  from my e-mail address. Leave the rest of the address intact
  including the "antispam" part. I had to take this measure to
  counteract unsollicited mail.)

"Arthur Hoornweg" wrote...
> would anyone know how I can delete all system restore points on drive
> C:\  programmatically (preferably in Delphi, but any other programming
> language will do also)?


I've written code to create restore points, but not delete them.  What you 
want is this:

http://msdn2.microsoft.com/en-gb/library/aa378934.aspx

-- 
Thanks,
Jon E. Scott
Blue Orb Software
http://www.blueorbsoft.com 

This is basically how many system works, you must set the relevent registry 
keys and then stop the system restore service.

When the service is restarted, it will delete all it's own restoration 
points...

"Steve McGrath"  wrote in message 
news:47680ff7$1@newsgroups.borland.com...
> Arthur Hoornweg wrote:
>> Hello all,
>>
>> would anyone know how I can delete all system restore points on drive
>> C:\  programmatically (preferably in Delphi, but any other programmin