How RebootGuard keeps every PC clean

When a device is Protected, Windows still works normally during the session: players can install, download and change settings. Those writes are redirected away from the protected disk.

At restart, the redirected changes are thrown away and the device boots into exactly the baseline you approved. Malware, junk files, broken drivers and changed settings all disappear.

On Windows 10/11 Enterprise, Education and IoT Enterprise, RebootGuard drives the Unified Write Filter (UWF) — a Microsoft feature designed exactly for this purpose. Writes go to an overlay that is cleared at restart.

Windows Pro does not include UWF. There, RebootGuard uses native-boot VHDX: Windows boots from a parent virtual disk, and each session writes to a differencing (child) disk that is reset at restart. Committing maintenance changes merges them into the parent.

The Master Console runs on your admin or cashier PC. It holds the license, the device list, groups and schedules, and signs every command with its private key.

The Client is a small Windows service on each gaming PC. It reports status every 30 seconds over an encrypted TLS channel and only executes commands signed by the Master it was enrolled with.

Select a single PC, a group like “VIP room”, or all devices, and click Protect or Maintenance. Group and all-device actions are expanded into one signed command per device, so a command can never affect a device it was not addressed to.

Maintenance is how you make permanent changes safely. Choose the mode that fits the job:

Choose which volumes are protected. A common layout keeps Windows protected on C: and the game library on its own drive, protected or not depending on how you update games.

You can exclude specific folders (for example D:\Games\Saves) and specific registry keys so they persist across restarts. Exclusions are validated: whole drives, C:\Windows, Program Files, C:\Users and similar system roots cannot be excluded, because that would silently disable protection.

Windows and game updates are installed during maintenance, then devices return to protection. RebootGuard itself receives signed updates on Stable or Beta channels, and every download on this site lists its SHA-256 hash.

If something goes wrong, a restart returns a protected PC to its baseline. Devices can also be restarted or switched to maintenance remotely, and the VHDX engine keeps a fallback boot entry.