Recover a black screen or failed startup immediately after System Restore

System Restore was started from Windows or Windows Recovery Environment. It reported success, reported failure, appeared to stall, or restarted the computer; Windows then produced a black screen, Automatic Repair, or a stop failure instead of the expected desktop.

System Restore reverts system files, registry settings, drivers, and installed programs represented by the selected restore point. It normally does not serve as a personal-file backup. A post-restore black screen can mean that the restore completed but restored an incompatible display/shell state, that the restore did not complete, or that staged driver files and their catalog/signature state no longer match. The first repair decision is therefore whether to let a staged restore finish once, undo it, or repair the resulting Windows image—not to run the same restore point repeatedly.

Searchable Windows error codes and exact messages

There is no unique Windows error code for a black screen after System Restore. Record the System Restore result dialog, stop code, Device Manager status, and recovery message exactly as Windows displays them.

Stable HRESULT names such as ERROR_ACCESS_DENIED, ERROR_INVALID_DATA, and ERROR_DIR_NOT_EMPTY explain the numeric result, not why the restore produced a black screen. Search the full result plus the path, driver, provider, or operation shown with it.

Use this procedure when Windows displayed normally before System Restore and the first black screen, recovery loop, or 0xC000021A failure appeared during the restore restart or immediately afterward. It applies whether the restore was launched from running Windows or WinRE, provided the correct Windows installation is identified and the disk remains consistently accessible.

Do not use this procedure merely because a restore point exists. It does not apply when the black screen predates the restore, the drive is absent, firmware and WinRE are also blank, BitLocker is still locked, Windows is showing an active restore progress screen, or a different explicit hardware/storage failure has been proven.

Do not use it for Windows Backup/System Image Recovery, OEM factory recovery, Reset this PC, or third-party disk-image restore. Those operations change different data and have different rollback paths.

The exact contents of the restore point, exact Windows build, and original reason the user chose System Restore may remain unknown during the first recovery attempt. Exact build/source details become mandatory only if the repair-source branch is reached.

The following may not remain unknown before changes:

• Whether System Restore reported success, reported failure, or never reached a final result
• The exact restore-point date/time and any displayed description
• The complete Details: text and hexadecimal code
• Whether WinRE offers Undo System Restore
• Whether 0xC000021A appears
• For the Windows 10-only F7 branch, whether updates were installed after the selected restore point and the first restart then failed with 0xC000021A
• Whether Safe Mode or Task Manager is visible
• The detected offline Windows volume before commands are run
• Whether the black screen follows every account or only one profile

• Windows Recovery Environment or a working Windows 10/11 installation USB
• Stable power
• A backup of important data before another restore, offline image repair, update rollback, or reset
• One known-working display connection
• Enough free space on the Windows volume for copied event and servicing logs
• Administrator access if Safe Mode or Task Manager reaches a command prompt
• Compatible Windows installation media only if DISM requests a source

If System Restore still displays changing progress text, moving animation, or continuing storage activity, wait. Windows provides no single reliable completion time. Proceed after a final result, a restart into black screen/Automatic Repair, or an already-established nonresponsive state—not because an arbitrary number of minutes passed.

Disconnect docks, extra displays, external GPUs, unrelated storage, and nonessential USB devices. Do not select the same restore point again. Do not delete restore points, take ownership of System Volume Information, or clear event logs.

Enter WinRE through the existing Automatic Repair screen, Shift+Restart when available, or Windows installation media followed by Repair your computer.

Before choosing Undo System Restore, preserve the offline evidence. Detect the Windows letter; never assume it is C::

diskpart
list volume
select volume <Windows-volume-number>
detail volume

If the verified Windows volume has no letter and W: is unused, assign it temporarily and record that it must be removed before leaving WinRE:

assign letter=W
detail volume
exit

If it already has a letter, leave that letter unchanged, exit DiskPart, and substitute it for W: below. Confirm the installation:

dir W:\Windows\System32\Config\SYSTEM
dir W:\Windows\System32\winlogon.exe

Create and populate an evidence folder:

md W:\FixItEvidence
copy W:\Windows\System32\winevt\Logs\Application.evtx W:\FixItEvidence\Application-after-restore.evtx
copy W:\Windows\System32\winevt\Logs\System.evtx W:\FixItEvidence\System-after-restore.evtx
copy W:\Windows\System32\winevt\Logs\Setup.evtx W:\FixItEvidence\Setup-after-restore.evtx
copy W:\Windows\Logs\CBS\CBS.log W:\FixItEvidence\CBS-after-restore.log
copy W:\Windows\Logs\DISM\dism.log W:\FixItEvidence\DISM-after-restore.log
copy W:\Windows\System32\Logfiles\Srt\SrtTrail.txt W:\FixItEvidence\SrtTrail-after-restore.txt
dism /Image:W:\ /Get-Packages /Format:Table > W:\FixItEvidence\packages-after-restore.txt
dism /Image:W:\ /Get-Drivers /Format:Table > W:\FixItEvidence\drivers-after-restore.txt

Some optional logs may not exist. Record the missing file and preserve the rest; do not create or edit files inside the Windows log directories.

1. Photograph or transcribe the entire System Restore result, including Details:, file/path, restore-point time, and hexadecimal code.

2. Determine whether the failure is a genuine black screen or a hidden stop/recovery cycle:

   • If 0xC000021A appears, record it. Branch A becomes eligible only if the exact Windows 10 update/restore sequence in step 4 is also proven.
   • If Preparing Automatic Repair or Startup Repair couldn't repair your PC appears, preserve SrtTrail.txt and continue.
   • If the pointer moves and Ctrl+Alt+Delete opens, test Task Manager and Explorer in step 5.

3. From WinRE, select Troubleshoot > Advanced options > System Restore only far enough to inspect the available choices. Do not start another restore point yet.

   • If Undo System Restore is offered, Windows has a rollback path to the pre-restore state. Branch B is available.
   • If it is not offered, do not fabricate an undo point or delete restore data. Continue with the remaining evidence.

4. Use Microsoft's F7 one-boot completion path only when all four facts are established:

   • the installed system is Windows 10;
   • one or more Windows updates were installed;
   • the selected restore point predates those updates; and
   • the first restore restart failed with 0xC000021A.

   That sequence supports the documented temporary driver/catalog mismatch. If any fact is missing—or the system is Windows 11—skip this test and use Undo System Restore or the evidence-supported repair branch. When all four facts are present:

   • Return to Advanced options.
   • Select Startup Settings > Restart.
   • Select 7 or F7 — Disable driver signature enforcement.
   • Let Windows continue without interruption.

   If System Restore resumes and completes, note the final result and use Branch A. This Startup Setting applies to that boot; it is not permission to install an unsigned driver or permanently disable signature enforcement.

5. At a stable black screen, press Windows key + Ctrl + Shift + B, then Ctrl+Alt+Delete.

   • If Task Manager opens, run explorer.exe.
   • If Explorer restores the desktop, record the shell processes and use Branch C.
   • If the graphics reset restores the display, inspect display-driver state in Safe Mode and use Branch D.

6. Test Safe Mode through Startup Settings > Restart > 4 or F4.

   • If Safe Mode is visible and normal mode is black, inspect display adapters, shell events, and accounts.
   • If Safe Mode is also black but Task Manager works, the shell/profile path remains possible.
   • If Safe Mode, normal mode, and WinRE all lose display, stop and test the physical display/GPU path.

7. In Safe Mode, open Device Manager > Display adapters. Record Device status, driver provider/date/version, and whether rollback is available. Do not change the driver yet.

8. If a second existing account is available, sign into it. If no second account exists and an administrator Command Prompt is available, create a temporary standard account:

   net user FixItTest * /add
   

   Enter a temporary password at the prompts, then sign out and test that account. If it has a normal desktop, the restored per-user state is implicated; use Branch C.

9. If Windows reaches a temporary desktop, open Event Viewer and inspect Windows Logs > Application for source System Restore or Microsoft-Windows-System-Restore at the restore time. Also inspect Application Error, User Profile Service, and the System log for display/driver failures. Export the logs before another restore attempt.

10. Read the saved SrtTrail-after-restore.txt, CBS log, and DISM log. A generic Startup Repair couldn't repair your PC result is not enough to rebuild BCD or replace boot files. Use only the component, package, driver, or path actually named.

11. Run a read-only file-system check when System Restore reported scanning or path errors:

    chkdsk W:
    

    If it reports no errors, do not escalate to /r. If it reports corruption or unreadable sectors, back up/image important data and assess drive health before any write-mode CHKDSK.

Choose the first evidence-supported branch. Do not combine finish the restore, undo the restore, driver rollback, and offline repair in one unmeasured attempt.

Branch A — Windows 10 update/restore/catalog mismatch ending in 0xC000021A: let the restore finish once

1. Reconfirm the exact four-part Windows 10 sequence from section 7. If the restore point did not predate installed updates, 0xC000021A was not the first restart result, or this is Windows 11, do not use this branch.
2. Use Startup Settings > Restart > 7 or F7 — Disable driver signature enforcement for this one boot only.
3. Do not press keys or force a shutdown while System Restore resumes.
4. When Windows displays the System Restore result, record it before closing the dialog.
5. Restart normally without selecting option 7/F7 again.
6. If Windows reaches the desktop normally, open Device Manager and record every display adapter or other device with Code 31, 39, 43, or 52.
7. Install only a current, model-appropriate, correctly signed replacement for an evidenced mismatched driver.
8. Run Windows Update after the machine is stable so restored system/catalog files receive the appropriate current servicing, then restart normally.
9. If Windows starts only when option 7/F7 is selected, if the restore never completes, or if 0xC000021A returns on the next normal boot, stop repeating F7 and use Branch B.

Branch B — Undo the failed or harmful System Restore

1. In WinRE, select Troubleshoot > Advanced options > System Restore.
2. Select Undo System Restore.
3. Confirm that the description and time correspond to the restore that immediately preceded the black screen.
4. If Scan for affected programs is available, review and record its result.
5. Select Next > Finish and confirm the undo.
6. Keep the computer on stable power and do not interrupt it.
7. Restart when prompted.
8. If the pre-restore desktop returns, preserve the evidence and address the original problem by its own mechanism. Do not select the same restore point again.
9. If Undo reports a code, record the complete message. Do not keep retrying the undo against an unchanged state; continue to Branch E or F depending on the error.
10. If Undo System Restore is absent, skip this branch. Do not delete restore-point files or use registry edits to manufacture an undo option.

Branch C — Explorer or another account proves a shell/profile problem

1. From Task Manager, run explorer.exe and keep the temporary desktop open long enough to save logs.

2. Inspect recently restored taskbar, Start-menu, theme, Explorer, shell-extension, and security software.

3. Uninstall or update only the component whose restored version and crash event coincide with the failure. Use Windows 11 Settings > Apps > Installed apps or Windows 10 Settings > Apps > Apps & features.

4. Query the machine-wide shell values:

   reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
   reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
   

5. Run echo %SystemRoot%. If Shell is explorer.exe and Userinit is <the-displayed-SystemRoot>\system32\userinit.exe,, do not rewrite them.

6. If a second account works but the original does not, preserve the original profile and migrate personal data selectively to a new account. Do not copy NTUSER.DAT or the entire AppData tree.

7. Restart normally and test both the affected and comparison accounts.

Branch D — Safe Mode and display evidence identify a restored graphics-driver problem

1. In Safe Mode, open Device Manager > Display adapters > <actual adapter> > Properties > Driver.
2. Record the provider/date/version.
3. If Roll Back Driver is available and returns to the version that worked before the restore mismatch, select it, give the truthful reason, and restart.
4. If rollback is unavailable, select Uninstall device for only the implicated adapter. On the first test, do not remove the driver package permanently.
5. Restart so Windows can use a basic or previously staged driver.
6. If that restores the display, install the exact model's current signed driver. On a hybrid-graphics system, change one adapter at a time.
7. For Code 52, replace the driver with a correctly signed version. Do not make option 7/F7, test-signing, or disabled integrity checks a permanent fix.
8. If Code 43 persists with a basic known-good driver, stop and test hardware/power rather than assuming System Restore remains the only cause.

Branch E — System Restore displayed a specific failure code

The HRESULTs in this branch are generic and some published associations are legacy. Use a sub-branch only when Windows actually displayed that exact code with this restore attempt and preserve the complete Details: text. Do not infer a Windows 10/11 restore mechanism from the number alone.

1. For 0x80070005:

   • Preserve the file/path and program named after Details:.
   • Prefer Undo from WinRE to return to the pre-restore state.
   • If the machine recovers and a third-party security or backup program demonstrably held the named file, update or temporarily stop only that program before a future restore from WinRE. Do not broadly disable Windows security.

2. For 0x80070091:

   • Do not delete or rename WindowsApps, WinSxS, System Volume Information, or package directories.
   • Undo the restore when available.
   • After Windows is stable, run the component/file checks in Branch F and choose a different restore point only if another restore is still necessary.

3. For 0x80070057 with a file-system scan message:

   • Run the read-only chkdsk W: check from section 7.

   • If logical errors are reported and user data is backed up, run one repair pass:

     chkdsk W: /f
     

   • Do not add /r unless separate storage evidence justifies a full surface scan and the data-risk/time tradeoff is accepted.

   • Reassess drive health if errors recur.

4. For 0x8007000D or 0x8000FFFF:

   • Undo the restore if available.
   • If Windows returns to its prior state, do not reuse the same restore point.
   • Check the Windows image in Branch F before selecting a different point from WinRE.

5. If a code names a specific path, provider, or driver not covered here, follow that evidence. The numeric code alone is not authority to delete the named file.

Branch F — Undo is unavailable or completed, but Windows files remain damaged

Use this branch only after evidence is saved and System Restore is no longer actively resuming. Do not service the image in the middle of an active restore.

1. From WinRE Command Prompt, reconfirm the detected Windows volume:

   dir W:\Windows\System32\Config\SYSTEM
   

2. Scan the offline component store:

   DISM /Image:W:\ /Cleanup-Image /ScanHealth
   

3. If DISM reports no component-store corruption, do not run repeated DISM repairs. Run SFC once:

   sfc /scannow /offbootdir=W:\ /offwindir=W:\Windows /offlogfile=W:\FixItEvidence\sfc-after-restore.txt
   

4. If DISM reports that the image is repairable, run:

   DISM /Image:W:\ /Cleanup-Image /RestoreHealth
   sfc /scannow /offbootdir=W:\ /offwindir=W:\Windows /offlogfile=W:\FixItEvidence\sfc-after-restore.txt
   

5. If 0x800F081F appears, exact source compatibility becomes required. Record the target image version printed by DISM, installed edition, and language, then inspect matching media:

   DISM /Image:W:\ /Get-CurrentEdition
   DISM /Image:W:\ /Get-Intl
   DISM /Get-WimInfo /WimFile:M:\sources\install.wim
   

6. Inspect every candidate index before selecting one:

   DISM /Get-WimInfo /WimFile:M:\sources\install.wim /Index:<candidate-index>
   

   Require matching language, architecture, edition, Windows version/build, and servicing level; reject a source older than the installed target. If architecture cannot be proven, stop. If the media contains only install.esd, it may be inspected, but this article does not assume an unvalidated Source:esd: form; obtain a documented compatible WIM or other validated source.

7. After proving the compatible WIM index, use the documented WIM source:

   DISM /Image:W:\ /Cleanup-Image /RestoreHealth /Source:wim:M:\sources\install.wim:<matching-index> /LimitAccess
   

8. Run SFC again only after DISM succeeds.

9. If SFC says a system repair is pending, stop. Reboot once normally only if System Restore has definitively completed or been undone. If the same message returns, do not use /RevertPendingActions; that command can discard staged servicing/restore work and requires a separate confirmed servicing diagnosis.

10. If DISM reports the image is non-repairable, preserve data and plan a supported repair reinstall or recovery rather than copying individual system files.

11. If—and only if—you assigned W: temporarily in section 6, remove it before leaving WinRE. Reidentify the same volume by number and details; never remove a pre-existing Windows letter:

    diskpart
    list volume
    select volume <same-Windows-volume-number>
    detail volume
    remove letter=W
    detail volume
    exit
    

Branch G — Recover Windows without repeating the same restore point

1. If Undo returned the machine to its pre-restore state and the original problem still needs repair, diagnose that original problem separately.
2. If another restore is still justified, launch System Restore from WinRE, select a different earlier restore point, and use Scan for affected programs before confirming.
3. Do not select a point simply because it is older; choose one whose date precedes the evidenced driver/application/configuration change.
4. If Windows 11 can reach a usable desktop, prefer Settings > System > Recovery > Fix problems using Windows Update > Reinstall now when available. It reinstalls the current Windows version while preserving apps, files, and settings. Keep the computer on continuous power and internet. The option is unavailable on Windows 10, managed devices, Windows 11 before 22H2, and systems missing Microsoft's prerequisite update.
5. If that option is unavailable, a repair installation from compatible media is the next non-destructive escalation when Windows can still run Setup.
6. Use Reset this PC > Keep my files only after backups are verified and the effect on applications/settings is accepted. A clean installation is a last resort, not evidence that System Restore itself was the root cause.

• On Windows 10, option 7/F7 lets System Restore resume after the proven update/older-restore-point/0xC000021A sequence, and the next normal boot works: The documented staged driver/catalog mismatch is strongly supported. Replace only an evidenced incompatible driver and bring Windows servicing current.
• Undo System Restore returns the pre-restore desktop: The selected restore state was harmful or incomplete. Do not reuse the same point.
• Explorer restores the desktop: The restored shell state, extension, or profile is more likely than boot files.
• Safe Mode works and an earlier/basic display driver fixes normal mode: The restored graphics stack is strongly implicated.
• A second account works: The restore affected per-user state; preserve and repair or replace that profile.
• CHKDSK reports recurring errors: Stop treating this as only a restore problem; protect data and investigate storage/file-system reliability.
• DISM/SFC repair files and normal boot returns: The image contained repairable corruption. Preserve CBS/DISM/SFC results because the original source of the damage may still be unresolved.
• Undo, the eligible Windows 10 F7 test, Safe Mode, driver rollback, and image repair all fail: Reclassify the boot stage and consider repair reinstall, hardware diagnosis, or recovery from a verified backup.

• Do not interrupt an actively progressing System Restore because it has no fixed completion time.
• Do not run the same restore point repeatedly after it produces the same failure.
• Do not delete or rename WindowsApps, WinSxS, System Volume Information, restore-point data, driver catalogs, or pending.xml to clear an error.
• Do not take ownership of protected package or restore directories as a troubleshooting shortcut.
• Do not permanently disable driver-signature enforcement, Secure Boot, test-signing protections, or Windows security.
• Do not use option 7/F7 on Windows 11 or on a Windows 10 case lacking the exact update/older-restore-point/0xC000021A sequence. Do not use it to install an unsigned driver; in this article it is only the documented one-boot Windows 10 recovery test.
• Do not run DISM /RevertPendingActions while a restore may still be staged.
• Do not rebuild BCD because Startup Repair failed unless the screen or SrtTrail.txt actually proves a BCD/boot-file defect.
• Do not assume System Restore is a personal-file backup. Verify important data separately.
• Do not run write-mode CHKDSK before protecting data when file-system or media errors are present.
• Do not assume the offline Windows installation is C:.

• Eligible Windows 10 F7 test: Restart normally. Driver-signature enforcement returns on the next standard boot; do not make a permanent policy change.

• Undo System Restore: This is the primary rollback to the pre-restore state. If it succeeds, retain the logs and do not immediately reapply the failed point.

• Display driver: Use Roll Back Driver or reinstall the recorded prior signed package if a replacement worsens the result.

• Winlogon or shell setting: Restore only from the specific registry export created before a change. Do not import an entire registry hive.

• Clean-boot or startup changes: Re-enable all unrelated recorded services and startup items.

• Temporary account: After comparisons and any data migration are complete, remove it:

  net user FixItTest /delete
  

• DISM/SFC: These repairs have no file-by-file undo. Use the verified backup if the image becomes less usable.

If Undo itself fails, do not try to reverse it by manually copying restored files. Preserve the new result and move to the image-repair or supported recovery branch.

1. Start Windows normally twice without F7, Safe Mode, or Task Manager intervention.
2. Confirm no 0xC000021A, Automatic Repair loop, or new System Restore failure appears.
3. Sign in to the original account and confirm desktop, taskbar, Start, and Explorer remain available.
4. If another account was used, verify the account-specific conclusion still holds.
5. In Device Manager, confirm the intended display adapter reports This device is working properly and no Code 31, 39, 43, or 52.
6. In Event Viewer, review the Application log for the System Restore result and confirm no new matching error was recorded after the recovery.
7. Review Reliability Monitor for new display, hardware, shell, or Windows failures.
8. If DISM/SFC was used, save its final log and confirm a subsequent scan does not report the same unresolved corruption.
9. Test one sleep/resume cycle and one full shutdown/cold start.
10. Verify user files and required applications before deleting the temporary account, old profile, backup, or evidence folder.

Confidence is approximately 80% when the failure begins on the System Restore restart and one independent result—a successful Undo System Restore, Safe Mode plus display-driver evidence, a working second account, or the exact documented Windows 10 update/older-restore-point/0xC000021A sequence followed by successful one-time F7 completion—isolates the path and the repair survives two normal starts.

Confidence is lower when the restore was force-interrupted, its result message was not captured, several repair attempts changed the state, the selected restore point is unknown, or pre-existing disk/display failures were already present.

Stop and escalate when the Windows volume cannot be identified, Undo and System Restore both report new unexplained errors, file-system errors recur, the disk or GPU disappears, WinRE is also blank, DISM declares the image non-repairable, a compatible repair source cannot be proved, SFC remains blocked by pending repair after one appropriate restart, user data is not backed up, or the machine starts only with driver-signature enforcement disabled.