CreateRestorePoint Method of the SystemRestore Class
http://msdn.microsoft.com/en-us/library/aa378847(VS.85).aspx
CONST cRestorePointType = 10
CONST cEventType = 100
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\default")
Set objItem = objWMIService.Get("SystemRestore")
errResults = objItem.CreateRestorePoint(Now & " - Scripted restore point", cRestorePointType, cEventType)
wscript.echo "Result of procedure call => " & errResults
wscript.sleep 60000
RestorePointType [in]
APPLICATION_INSTALL
0 An application has been installed.
APPLICATION_UNINSTALL
1 An application has been uninstalled.
DEVICE_DRIVER_INSTALL
10 A device driver has been installed.
MODIFY_SETTINGS
12 An application has had features added or removed.
CANCELLED_OPERATION
13 An application needs to delete the restore point it created. For example, an application would use this flag when a user cancels an installation.
EventType [in]
BEGIN_NESTED_SYSTEM_CHANGE
102 A system change has begun. A subsequent nested call does not create a new restore point. Subsequent calls must use END_NESTED_SYSTEM_CHANGE, not END_SYSTEM_CHANGE.
BEGIN_SYSTEM_CHANGE
100 A system change has begun. A subsequent call must use END_SYSTEM_CHANGE, not END_NESTED_SYSTEM_CHANGE.
END_NESTED_SYSTEM_CHANGE
103 A system change has ended.
END_SYSTEM_CHANGE
101 A system change has ended.