Reset, reimage or repair: choose and do it

Microsoft puts Reset this PC at the bottom of its list of recovery options, and says a recovery typically takes 30 minutes to 2 hours, the lighter options less than a reset. Resetting still happens more often than it should, because it is the fix that always seems to work: it ends a long diagnosis, and it removes the user’s apps and settings along with the fault. A technician who can choose between repair, reset, reimage and replacement, and say why, saves the user the afternoon of reinstalling.

You will choose by the cause, read what sfc and DISM say about the next rung, run a reset after the preparation that prevents data loss, tell it apart from the reset and reimage an organisation uses, and sign phones and Macs out so that the next owner is not locked out.

Repair, reset, reimage or replace: decide from the cause

Four words cover the options, and they are often mixed up. A repair mends one known fault and leaves the installation as it was. A resetReset this PC: The Windows recovery option that reinstalls Windows on the same PC. It always removes apps and settings, and you choose to keep personal files or remove everything, from Settings or from WinRE. reinstalls Windows on the same PC, removing apps and settings. A reimagereimage: Writing a prepared system image over a PC's disk so that it returns to the organisation's standard build. Local data is replaced, so what must be kept is backed up before. writes a known image over the disk, which is how an organisation returns a PC to its standard build. A replacement swaps the device when the hardware is the problem.

Choose by the cause. If it is known and contained, repair, because it is the smallest change that fixes it. If the system is unstable, compromised, or faster to rebuild than to debug, reset or reimage. If the hardware is failing or out of support, replace, because a fresh system on a failing disk fails again. Microsoft’s list for a PC that starts but misbehaves gives the same shape, least disruptive first:

1. run a troubleshooter;
2. reinstall the current version of Windows 11 without touching files and apps (22H2 or later);
3. uninstall a recent update, or go back to the previous version within 10 days of an upgrade;
4. point-in-time restore (24H2 or later);
5. and only then, Reset this PC.

Answer four questions about the system in front of you in the table, and watch which routes the answers rule out:

A program applies one such rule order to twelve invented situations and prints the action, a reason code and whether the data must be backed up first. Press Edit, change a case, and see which rule decides:

# Twelve invented support situations and one rule order that picks repair, reset, reimage or replace for each.
# The order is MySmartCoPilot's rule of thumb, built on Microsoft's "least disruptive first" list; the conditions are facts
# a technician can collect in the first minutes of a call.


def decide(case):
    """Return (action, reason code). Earlier rules win over later ones."""
    if case["hardware_failing"]:
        return "replace", "HARDWARE"
    if case["compromised"]:
        return ("reimage", "COMPROMISED-MANAGED") if case["managed"] else ("clean-install", "COMPROMISED-HOME")
    if case["cause"] == "update":
        return "uninstall-update", "UPDATE-KNOWN"
    if case["cause"] == "driver":
        return "roll-back-driver", "DRIVER-KNOWN"
    if case["cause"] == "system-files":
        return "dism-then-sfc", "FILES-KNOWN"
    if case["managed"]:
        return "reimage", "UNKNOWN-MANAGED"
    return "reset-keep-files", "UNKNOWN-HOME"


CASES = [
    ("fin-laptop-1", dict(hardware_failing=False, compromised=False, cause="update", managed=True, unsaved=False)),
    ("fin-laptop-2", dict(hardware_failing=False, compromised=False, cause="system-files", managed=True, unsaved=True)),
    ("dev-workstation", dict(hardware_failing=False, compromised=False, cause="driver", managed=True, unsaved=False)),
    ("reception-pc", dict(hardware_failing=False, compromised=False, cause="unknown", managed=True, unsaved=False)),
    ("home-laptop-a", dict(hardware_failing=False, compromised=False, cause="unknown", managed=False, unsaved=True)),
    ("home-laptop-b", dict(hardware_failing=False, compromised=False, cause="update", managed=False, unsaved=False)),
    ("kiosk-3", dict(hardware_failing=False, compromised=True, cause="unknown", managed=True, unsaved=False)),
    ("sales-laptop", dict(hardware_failing=False, compromised=True, cause="unknown", managed=False, unsaved=True)),
    ("lab-pc-7", dict(hardware_failing=True, compromised=False, cause="unknown", managed=True, unsaved=False)),
    ("old-desktop", dict(hardware_failing=True, compromised=False, cause="system-files", managed=False, unsaved=True)),
    ("hr-laptop", dict(hardware_failing=False, compromised=False, cause="system-files", managed=False, unsaved=False)),
    ("ops-tablet", dict(hardware_failing=False, compromised=False, cause="unknown", managed=True, unsaved=True)),
]
NEEDS_BACKUP_IF_UNSAVED = {"reimage", "clean-install", "reset-keep-files", "replace"}

print("device".ljust(16) + "action".ljust(18) + "reason".ljust(21) + "back up first")
need_backup = 0
for name, case in CASES:
    action, code = decide(case)
    backup = action in NEEDS_BACKUP_IF_UNSAVED and case["unsaved"]
    need_backup += backup
    print(name.ljust(16) + action.ljust(18) + code.ljust(21) + ("yes" if backup else "-"))

counts = {}
for _name, case in CASES:
    action = decide(case)[0]
    counts[action] = counts.get(action, 0) + 1
print()
print(", ".join(f"{action}: {n}" for action, n in sorted(counts.items())))
print(f"{need_backup} of {len(CASES)} situations need a backup before anything is done")

device          action            reason               back up first
fin-laptop-1    uninstall-update  UPDATE-KNOWN         -
fin-laptop-2    dism-then-sfc     FILES-KNOWN          -
dev-workstation roll-back-driver  DRIVER-KNOWN         -
reception-pc    reimage           UNKNOWN-MANAGED      -
home-laptop-a   reset-keep-files  UNKNOWN-HOME         yes
home-laptop-b   uninstall-update  UPDATE-KNOWN         -
kiosk-3         reimage           COMPROMISED-MANAGED  -
sales-laptop    clean-install     COMPROMISED-HOME     yes
lab-pc-7        replace           HARDWARE             -
old-desktop     replace           HARDWARE             yes
hr-laptop       dism-then-sfc     FILES-KNOWN          -
ops-tablet      reimage           UNKNOWN-MANAGED      yes

clean-install: 1, dism-then-sfc: 2, reimage: 3, replace: 2, reset-keep-files: 1, roll-back-driver: 1, uninstall-update: 2
4 of 12 situations need a backup before anything is done

The order of the rules is the lesson. Failing hardware comes first, because no software route cures it, so lab-pc-7 and old-desktop both come out as replace. A compromised system comes second: a managed kiosk is reimaged, and an unmanaged sales laptop gets a clean installation. A known cause sits above the unknown-cause defaults, which is why fin-laptop-1 is an update to remove and not a reimage. Four of the twelve situations need a backup first, and every one of them is a route that removes or moves local data.

DISM and sfc repair files, and their results say when to stop

When the cause is damaged system files, the repair has two tools and an order. Microsoft’s support article says to run DISM before the System File Checker, because DISM provides the files that the repair needs. DISMDISM: Deployment Image Servicing and Management, the Windows tool that services system images and the component store; Dism /Online /Cleanup-Image /RestoreHealth asks Windows Update for a fresh copy of the store so that sfc has clean files to copy from. More in “Windows command line for support work” repairs the component storecomponent store: The WinSxS store where Windows keeps the files used to repair and update itself. DISM repairs it, and the System File Checker then copies clean files from it. from Windows Update by default; the System File CheckerSystem File Checker: The Windows tool sfc, which scans every protected system file against its cached original and replaces any copy it finds damaged; sfc /scannow runs the whole scan from an elevated prompt and reports the result when it finishes. More in “Windows command line for support work” then replaces damaged protected files with a cached copy. The commands, their options and the log are in Windows command line for support; this lesson is about what the results mean for the decision.

The repair sourcerepair source: Where DISM gets clean files when it repairs Windows: Windows Update by default, or a mounted image, a running installation, a side-by-side folder or a WIM file. is where DISM gets clean files when Windows Update cannot supply them. Microsoft lists five: Windows Update, a mounted Windows image, a running Windows installation shared on the network, a side-by-side folder on a share or installation media, and a WIM file on a network share with an index. Two warnings in the same page matter on a help desk: use only RTM media, because refresh media leaves out older file versions that the PC may need, and keep the source patched to the latest cumulative update, because a PC that is newer than its source can fail to repair.

Step through the ladder, from DISM to the last rung:

An sfc scan ends in one of four ways, and each has its own next step. A clean scan means the system files are fine, and the cause is somewhere else: stop repairing. A scan that could not run is repeated in safe mode. A scan that repaired files ends with a restart and a test. Only a scan that found files it could not repair moves down the ladder, and where it goes depends on three facts: whether DISM has run, whether the PC’s updates are managed, and whether the PC runs Windows 11 version 22H2 or later. The program applies those rules to seven scans:

# What to do after sfc has run, as a short rule order. The four outcome codes stand for the four kinds of result that
# Microsoft's support article lists; they are labels chosen for this program, not text copied from a PC.
# dism_done: DISM RestoreHealth finished before this scan.  managed_updates: updates on the PC are managed by the organisation.


def next_step(outcome, dism_done, managed_updates, win11_22h2):
    if outcome == "clean":
        return "stop repairing: the system files are fine, look at drivers, apps or the profile"
    if outcome == "could-not-run":
        return "run sfc again in safe mode, after checking the temporary folders exist"
    if outcome == "repaired":
        return "restart and test; close the repair, with sfc run once more as a check"
    if outcome == "unfixed":
        if not dism_done:
            return "run DISM RestoreHealth first, then sfc again"
        if win11_22h2 and not managed_updates:
            return "reinstall the current version of Windows from Windows Update (keeps files and apps)"
        if managed_updates:
            return "ask the endpoint team for a repair source or a reimage"
        return "plan Reset this PC with a backup first"
    raise ValueError(f"unknown outcome: {outcome}")


SCANS = [
    ("PC-01", "clean", True, False, True),
    ("PC-02", "could-not-run", False, False, True),
    ("PC-03", "repaired", True, False, True),
    ("PC-04", "unfixed", False, False, True),
    ("PC-05", "unfixed", True, False, True),
    ("PC-06", "unfixed", True, True, True),
    ("PC-07", "unfixed", True, False, False),
]
for name, outcome, dism_done, managed, new_enough in SCANS:
    print(f"{name}  {outcome:14} -> {next_step(outcome, dism_done, managed, new_enough)}")

unfixed = [row for row in SCANS if row[1] == "unfixed"]
print(f"\n{len(unfixed)} of {len(SCANS)} scans ended unfixed, and {sum(1 for row in unfixed if row[2])} of those already had DISM done")

PC-01  clean          -> stop repairing: the system files are fine, look at drivers, apps or the profile
PC-02  could-not-run  -> run sfc again in safe mode, after checking the temporary folders exist
PC-03  repaired       -> restart and test; close the repair, with sfc run once more as a check
PC-04  unfixed        -> run DISM RestoreHealth first, then sfc again
PC-05  unfixed        -> reinstall the current version of Windows from Windows Update (keeps files and apps)
PC-06  unfixed        -> ask the endpoint team for a repair source or a reimage
PC-07  unfixed        -> plan Reset this PC with a backup first

4 of 7 scans ended unfixed, and 3 of those already had DISM done

Four of the seven scans ended unfixed, and three of those already had DISM done, so only one of the four is told to run DISM. The others split by the facts about the PC: PC-05 can reinstall the current version of Windows, PC-06 is managed and goes to the endpoint team, and PC-07 is too old for the reinstall and plans a reset. The reinstall is worth knowing: it reinstalls the same version of Windows, repairs system files and components, and preserves apps, files and settings. It may be missing on PCs whose updates are managed.

Reset this PC keeps files at most, and needs preparing

A reset reinstalls Windows and always removes apps and settings. What it does with personal files is the one real choice, and Microsoft’s page names the options in plain terms:

Two notes belong with the table. Clean data is aimed at consumers, and Microsoft says it does not meet government or industry data erasure standards, so a company that disposes of devices follows its own standard. And the choice of source follows the fault: when the local files are suspect, use the cloud download.

Before it starts, Microsoft’s page asks for two things: back up important files, and have the BitLocker recovery key if the device is encrypted. A third is MySmartCoPilot’s rule of thumb, not Microsoft’s: keep the PC on mains power, because a reset can run for a long time. A reset can be started from Settings, under System, Recovery, or from WinRE under Troubleshoot, and from WinRE an encrypted device asks for its key. Step through a reset and notice where the preparation sits:

The step people get wrong is the middle one: the screen may stay black for a long time, occasionally upwards of 15 minutes, and restarting the PC by hand can make the reset fail. Tell the user before it starts. A program turns that preparation list into the gaps that remain for four PCs; try changing a PC so that it passes:

# What must be true before Reset this PC starts, as a list of gaps per PC. A backup and the BitLocker recovery key for an
# encrypted device are the items Microsoft's "Reset your PC" page names; mains power is a precaution added by practice.
PCS = [
    # name, backed_up, encrypted, key_known, on_power, option
    ("PC-A", True, True, True, True, "keep-my-files"),
    ("PC-B", False, False, False, True, "remove-everything"),
    ("PC-C", True, True, False, True, "remove-everything"),
    ("PC-D", True, False, False, False, "keep-my-files"),
]


def gaps(backed_up, encrypted, key_known, on_power, option):
    found = []
    if not backed_up:
        if option == "remove-everything":
            found.append("back up first: this option removes the personal files too")
        else:
            found.append("back up first: apps and settings are removed even when files are kept")
    if encrypted and not key_known:
        found.append("find the BitLocker recovery key before starting")
    if not on_power:
        found.append("connect power; the screen may stay black for a long time")
    return found


for name, backed_up, encrypted, key_known, on_power, option in PCS:
    problems = gaps(backed_up, encrypted, key_known, on_power, option)
    print(f"{name} ({option}): " + ("ready" if not problems else f"{len(problems)} gap(s)"))
    for problem in problems:
        print("   -", problem)

ready = sum(1 for pc in PCS if not gaps(*pc[1:]))
print(f"\n{ready} of {len(PCS)} PCs are ready to reset")

PC-A (keep-my-files): ready
PC-B (remove-everything): 1 gap(s)
   - back up first: this option removes the personal files too
PC-C (remove-everything): 1 gap(s)
   - find the BitLocker recovery key before starting
PC-D (keep-my-files): 1 gap(s)
   - connect power; the screen may stay black for a long time

1 of 4 PCs are ready to reset

Only PC-A is ready. PC-B has no backup, PC-C is encrypted and nobody has found its key, and PC-D is not on power. All three gaps cost nothing to close before the reset and a great deal after it. The lesson on BitLocker and FileVault recovery keys covers the key side.

A managed fleet resets to a known state, not a blank one

An organisation wants more than clean Windows: it wants the PC back as a managed device with the right policies and apps. Two routes do that. A reimage writes the organisation’s image, so every PC returns to the same build, and it suits PCs that are compromised or too far gone to repair. Windows AutopilotWindows Autopilot: Microsoft's service for setting up and resetting managed Windows PCs. Autopilot Reset removes personal files and apps but keeps the device's Entra ID and Intune connections. Reset takes a device back to a business-ready state. Microsoft’s page lists what it does: it removes personal files, apps and settings, reapplies the device’s original settings, and keeps the connection to Microsoft Entra ID and to Intune. It also keeps Wi-Fi details and the provisioning packages applied before, and it blocks the desktop until that information is restored and, for a PC in management, until a sync completes.

Three conditions govern the managed routes. A local Autopilot Reset is switched off by default, so that nobody triggers it by accident, and an administrator must enable the policy first. It does not support Microsoft Entra hybrid joined devices, which need a full wipe, and that wipe can take up to 24 hours before the device is ready to deploy again. And the reinstall from earlier, Fix problems using Windows Update, is not available on PCs whose updates are managed. So the managed fleet’s answer to “can we just reinstall it?” is a question about which route the organisation has set up, not about what Windows can do.

Phones and Macs: sign out first, or the next owner is locked out

The phone and the Mac have the problem from the other side: the vendors made it hard to reset a device that belongs to someone else, and that protection also catches a company that forgets to sign out. On an iPhone or iPad, Activation LockActivation Lock: A Mac feature that follows Find My: while it is on, the owner's Apple Account password or the device passcode is required before anyone can turn Find My off, erase the Mac, or reactivate and use it. More in “Install, reinstall and erase macOS” turns on with Find My, and the Apple Account password is required before anyone can turn off Find My, erase the device or reactivate it. Apple says that on iOS or iPadOS 15 and later the locked device shows an iPhone Locked to Owner screen, and not to take ownership of a used device that shows it. The Mac works the same way, and Install, reinstall and erase macOS goes through that handover.

Android has the matching feature, factory reset protectionfactory reset protection: Android's device protection: after a factory reset the phone asks for the screen lock or the Google Account that was on it, and cannot be used if that is not given.. Google’s page says that once a Google Account and a screen lock are on the device, a factory reset asks for the screen lock or the Google Account password, and that someone who cannot give it will be unable to use the device at all afterwards. Turning protection off means removing the Google Account first. Google’s reset page adds the practical list: know the Google Account password, back up to the account, charge to at least 70 percent, connect to a network, and wait 24 hours after a password reset. A reset can take up to an hour.

Both vendors say the same thing about the next owner: the lock is the owner’s, so the owner clears it. There is no technician’s workaround. A device locked to a person you cannot reach goes back to them, or to the vendor’s own route with proof of purchase, and a company-managed device is released through its management service. The program checks the order of a handover checklist for six devices, with the sign-out step first for phones and Macs:

# Checks the order of a handover checklist for a device that is about to change hands. The required steps follow the
# vendors' pages: sign out of the account that locks the device, back up, erase, confirm the first setup screen, record.
REQUIRED = {
    "phone": ["sign-out-account", "back-up", "erase", "check-setup-screen", "record"],
    "mac": ["sign-out-account", "back-up", "erase", "check-setup-screen", "record"],
    "pc": ["back-up", "find-key", "erase", "check-setup-screen", "record"],
}

DEVICES = [
    ("phone-12", "phone", ["sign-out-account", "back-up", "erase", "check-setup-screen", "record"]),
    ("phone-13", "phone", ["back-up", "erase", "check-setup-screen", "record"]),
    ("mac-04", "mac", ["back-up", "sign-out-account", "erase", "check-setup-screen", "record"]),
    ("mac-05", "mac", ["sign-out-account", "erase", "back-up", "check-setup-screen", "record"]),
    ("pc-31", "pc", ["back-up", "find-key", "erase", "check-setup-screen", "record"]),
    ("pc-32", "pc", ["find-key", "erase", "record"]),
]


def check(kind, steps):
    """List what is missing and what is out of order, comparing with the required order."""
    required = REQUIRED[kind]
    problems = [f"missing {step}" for step in required if step not in steps]
    done = [step for step in steps if step in required]
    wanted = [step for step in required if step in done]
    if done != wanted:
        problems.append("steps are out of order")
    if "erase" in steps and "back-up" in steps and steps.index("erase") < steps.index("back-up"):
        problems.append("erased before the backup")
    return problems


clean = 0
for name, kind, steps in DEVICES:
    problems = check(kind, steps)
    clean += not problems
    print(f"{name:9} {kind:6} " + ("ok" if not problems else "; ".join(problems)))
print(f"\n{clean} of {len(DEVICES)} checklists are complete and in order")

phone-12  phone  ok
phone-13  phone  missing sign-out-account
mac-04    mac    steps are out of order
mac-05    mac    steps are out of order; erased before the backup
pc-31     pc     ok
pc-32     pc     missing back-up; missing check-setup-screen

2 of 6 checklists are complete and in order

Two of the six checklists are complete and in order. phone-13 skips the sign-out, which is the mistake that locks the next owner out; mac-05 erases before it backs up, which is the mistake that cannot be undone. The order is the control: sign out, back up, erase, then check that the first setup screen appears without asking for the old account, and record it.

Practise: choose the next step

After an sfc scan, the choice of next step depends on four facts and a fixed order. Write next_action(situation) to return a short action name for one scan, with the unknown outcome refused so that a typo never picks a step. Write the rules in the order the prompt gives them; the order is the lesson, as it was in the program of the first section.

def next_action(situation):
    """Return the next step after a System File Checker scan."""
    return "stop"

from next_action import next_action

BASE = {"outcome": "unfixed", "dism_done": True, "managed_updates": False, "win11_22h2": True}


def test_the_simple_outcomes():
    """maps a clean scan, a scan that could not run and a repaired scan to their steps"""
    assert next_action(dict(BASE, outcome="clean")) == "stop"
    assert next_action(dict(BASE, outcome="could-not-run")) == "safe-mode-scan"
    assert next_action(dict(BASE, outcome="repaired")) == "restart-and-test"


def test_unfixed_runs_dism_first():
    """sends an unfixed scan to DISM when DISM has not run yet"""
    assert next_action(dict(BASE, dism_done=False)) == "run-dism"
    assert next_action(dict(BASE, dism_done=False, managed_updates=True)) == "run-dism"


def test_unfixed_after_dism_reinstalls_the_current_windows():
    """reinstalls the current version on Windows 11 22H2 or later with unmanaged updates"""
    assert next_action(BASE) == "reinstall-current"


def test_unfixed_on_a_managed_pc_asks_the_endpoint_team():
    """asks the endpoint team when the organisation manages updates"""
    assert next_action(dict(BASE, managed_updates=True)) == "ask-endpoint-team"
    assert next_action(dict(BASE, managed_updates=True, win11_22h2=False)) == "ask-endpoint-team"


def test_unfixed_on_an_older_pc_plans_a_reset():
    """plans a reset with a backup when the reinstall is not available"""
    assert next_action(dict(BASE, win11_22h2=False)) == "reset-with-backup"


def test_unknown_outcomes_are_refused():
    """raises ValueError for an outcome it does not know"""
    for bad in ("fixed", "", None):
        try:
            next_action(dict(BASE, outcome=bad))
        except ValueError:
            continue
        raise AssertionError(f"next_action with outcome {bad!r} should raise ValueError")

The self-check that follows asks about the routes, the sfc results, the reset options, the managed resets and the handover order, with a reason on each answer. If you miss one about the rule order, go back to the first program and move a single fact in one case, say hardware_failing, to see which line of the output changes and which rule took over.

Interview questions

Warm-up (fresher): what does Reset this PC remove, and what does it keep?

It always removes apps and settings, because it reinstalls Windows. With Keep my files it keeps documents and photos; with Remove everything it removes personal files too, and Clean data goes further and cleans the drive, which is for a PC being donated or sold. Microsoft adds that this erasure is aimed at consumers and does not meet government or industry data erasure standards. Before it starts I back up, check that the BitLocker key is available if the PC is encrypted, and tell the user the screen may stay black for a long time.

Warm-up (fresher to 2-5 years): when would you reinstall Windows instead of resetting it?

When system files are damaged and the PC runs Windows 11 22H2 or later with updates that are not managed. The reinstall from Windows Update puts the same version back, repairs system files and components, and keeps apps, files and settings, so the user loses nothing. I try it after DISM and sfc have not cleared the damage and before a reset. On a managed PC the option may be missing, and then the question goes to the endpoint team.

Two harder calls follow, one about damaged files that will not repair and one about a phone that cannot be activated. Decide the first move on each before you compare it with the model answer:

Key takeaways

• Choose by the cause: repair a known, contained fault, reset or reimage a system that is unstable, compromised or faster to rebuild, and replace failing or unsupported hardware, because no software route cures a failing disk.
• Run DISM before the System File Checker, use a repair source that matches the PC’s patch level, and treat only an unfixed scan as a reason to go further down the ladder.
• The reinstall of the current Windows version keeps apps, files and settings, so it comes before Reset this PC on Windows 11 22H2 or later when the PC’s updates are not managed.
• Reset this PC always removes apps and settings; the choice is about personal files, and a backup, the BitLocker key and mains power come first.
• A managed fleet uses Autopilot Reset or a reimage to return a PC to a managed state, and the right route depends on what the organisation has set up.
• On phones and Macs the sequence is sign out, back up, erase and check the first setup screen, because Activation Lock and factory reset protection leave the next owner locked out otherwise.