KEH-TECH

How to repair Windows system files with SFC and DISM

14 min read

0:00 15:22

KB ID 2610140001

You want to check Windows for damaged or missing system files and put them right using the tools that ship with Windows. Typical reasons: a Windows feature or app misbehaves, a cumulative update or a role or feature install fails, or you see crashes that point at corrupted operating system files. The two tools are DISM (Deployment Image Servicing and Management), which repairs the component store, and SFC (System File Checker), which checks the protected system files and replaces bad ones. When you run them in the right order the result looks like this:

Windows Resource Protection did not find any integrity violations.

Applies to: Windows 10, Windows 11 and Windows Server. The commands are the same on all of them. Run every command from an elevated Command Prompt (search for cmd, then Run as administrator). Both tools need administrator rights.

What is going on

Windows keeps a master copy of its own components in the component store, the C:\Windows\WinSxS folder. The files you actually run, such as those in C:\Windows\System32, are checked against that store. Damage can happen at either level, and the two tools split the work between them:

  • SFC scans all protected system files. When it finds one that is wrong, it replaces it with a good copy from the store. Microsoft’s SFC log analysis shows this as “Repairing corrupted file … from store”.
  • DISM with /RestoreHealth scans the component store itself for corruption and repairs it, by default by downloading good files from Windows Update.

That is why the order matters. If the store is damaged, SFC has nothing good to copy from, so it fails or only half repairs. Microsoft’s own instructions say it directly: DISM provides the files required to repair the corrupted files, and you should run DISM before running System File Checker.

Diagnosis

1. Before you start: check first

  • Back up, or snapshot. On a physical PC, make sure important data is backed up. On a server or VM, take a checkpoint or snapshot first. Neither tool should lose data, but a repair on a machine that is already unhealthy is the wrong moment to find out.
  • Restart if updates are pending. Finish any pending restart before you begin.
  • Allow time and a connection. DISM takes several minutes at least. By default it downloads replacement files from Windows Update, so the PC needs internet access or access to your update server, unless you are using an offline source (below).
  • Do not close the window. Microsoft warns not to close the Command Prompt window until the SFC verification is 100 percent complete.

2. Optional: look without repairing

If you only want to know whether anything is wrong, both tools can check without repairing. These are read-only checks:

DISM.exe /Online /Cleanup-Image /CheckHealth
DISM.exe /Online /Cleanup-Image /ScanHealth
sfc /verifyonly

/CheckHealth reports whether the image has already been flagged as corrupted and whether it can be repaired. /ScanHealth scans the component store for corruption and takes several minutes. /verifyonly scans the protected files without making any repairs. Microsoft documents /CheckHealth as reporting the image as healthy, repairable or non-repairable. If it is non-repairable, skip to “If it still fails” below.

Root cause

The cause is not one thing. Files in the component store or in the system folders have been damaged, replaced or gone missing. Typical triggers are an interrupted update, a disk fault, or software that changed a protected file, but the logs, not a guess, tell you which. Most of the time the damage is small, and the store has or can fetch a good copy. Why this works: DISM makes the store whole, then SFC makes the live files match it.

The fix

Before you start: do these steps in order and on one machine at a time. Do not stop DISM or SFC part way through; a half-finished servicing operation is a worse state than the one you started with. The commands change system files, so on a server take a snapshot or checkpoint first.

Step 1: repair the component store with DISM 

DISM.exe /Online /Cleanup-Image /RestoreHealth

This scans the store and repairs what it finds, normally using Windows Update as the source. It takes several minutes. When it finishes it reports whether the operation succeeded. If it fails, read the “DISM fails” part of the next section before you do anything else.

Step 2: check and repair the system files with SFC 

sfc /scannow

This scans every protected system file and replaces corrupted ones. The result is one of the four messages in the table below.

SFC messageWhat it means and what to do
Windows Resource Protection did not find any integrity violations.No missing or corrupted system files. You are done, and the fault is somewhere else.
Windows Resource Protection found corrupt files and successfully repaired them.It worked. Restart, then run sfc /scannow once more to confirm. Details are in CBS.log.
Windows Resource Protection found corrupt files but was unable to fix some of them.Read CBS.log to find which files (next section). Make sure DISM completed first, then run SFC again after a restart.
Windows Resource Protection could not perform the requested operation.Microsoft says to run the scan in Safe Mode, and to make sure the PendingDeletes and PendingRenames folders exist under %WinDir%\WinSxS\Temp.

Restart the PC, then run sfc /scannow once more. Repeat until it reports no integrity violations. Running it a second time is normal: the first run repairs, the second confirms.

Read the results: CBS.log

SFC writes every verification and repair to %windir%\Logs\CBS\CBS.log, with each SFC line tagged [SR]. The log is shared with the Windows Modules Installer service, so it is long. Pull out only the SFC lines and put them on your desktop:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

The file holds the entries from every time SFC has run on that PC, so check the dates and look only at the last run. SFC checks files in groups of 100, so you will see many groups of lines. These are the entries that matter:

Log entryWhat it means
Verify complete and nothing else in the groupThe group of 100 components was fine.
Repairing corrupted file ... from storeA problem was found and SFC can fix it by copying from the component store. Microsoft notes that this line also appears when files are only verified, with no repair made.
Repaired file ... by copying from backupA problem was found and SFC fixed it from a private backup copy.
Cannot repair member file ...The file does not match what Windows expects and SFC cannot repair it. The line names the file and component. The sample in Microsoft’s own article ends with “in the store, file is missing”, which means the store itself has no good copy: go back and fix the store with DISM.

DISM keeps its own log at C:\Windows\Logs\DISM\dism.log. Error messages from DISM point at it. The component store repair also writes to CBS.log, where Microsoft says to look for the line “Checking System Update Readiness”.

If DISM fails: use an offline source

The usual failure is 0x800f081f: “The source files could not be found. Use the Source option to specify the location of the files that are required to restore the feature.” Microsoft lists this code as CBS_E_SOURCE_MISSING. Two related codes are 0x800F0906 (the source files could not be downloaded) and 0x800F0907 (group policy stops Windows reaching the internet). All three mean DISM could not get good files from Windows Update. Give it another source with /Source, and add /LimitAccess so that it does not try Windows Update at all.

The source can be a mounted Windows image, a running Windows installation, a side-by-side (sources\sxs) folder from install media, or a WIM file. You need matching media:

  • The same Windows version and build as the PC. Check with winver.
  • The same language. Microsoft says a repair source must include all the language packs for the locales the image supports.
  • Patched to the latest cumulative update. Microsoft says that if the target is patched higher than the source, the repair may fail, because the PC needs updated files that are not in the source. Microsoft also says to use only RTM media for a source, and not “refresh” media, which leaves out older file versions that the target may need.

Mount the ISO, or insert the media, and list the images in install.wim (D: here is the mounted ISO):

DISM /Get-ImageInfo /ImageFile:D:\sources\install.wim

Microsoft notes that a WIM can contain more than one image, so note the index whose name matches the edition that is installed (on a client PC the edition is shown under Settings, System, About) rather than guessing. Then run the repair with that index. Microsoft’s syntax for a WIM source is the wim: prefix, the path, a colon, and the index:

DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccess

If the image is already mounted, or you have the sources\sxs folder, point /Source at the mounted Windows folder or at that sxs folder instead. If you give more than one /Source, DISM uses the first location that has the file. When it finishes, run sfc /scannow as before. [UNCONFIRMED: install media that holds install.esd instead of install.wim. Microsoft Learn documents the wim: prefix for WIM files. We did not find an equivalent documented esd: form, so use install media that contains install.wim.]

If Windows will not start: run it from WinRE

If the PC cannot boot, run both tools against the offline Windows installation from the Windows Recovery Environment. Start WinRE from Windows installation media: boot the media, on the Install Windows screen select Next then Repair your computer, and on the System Recovery Options screen select Next then Command Prompt. [UNCONFIRMED: the exact screen names on current Windows 11 and Windows Server builds. Microsoft documents these steps and also lists other ways into WinRE.] In the recovery Command Prompt the drive letters are often different from the normal ones, so find the system volume first. Run BCDEdit and look at osdevice in the Windows Boot Loader section. This article uses D: as the example letter. Replace it with yours.

In WinRE, point DISM at the offline drive with /Image:, as below, not at /Online. Microsoft’s WinRE guide uses /image:D:\ with the system volume’s drive letter. If the drive is encrypted with BitLocker it will need unlocking before it can be read. [UNCONFIRMED: the exact BitLocker unlock steps in WinRE were not checked against Microsoft documentation here.]

BCDEdit
SFC /scannow /offbootdir=D:\ /offwindir=D:\windows
DISM /image:D:\ /cleanup-image /restorehealth

This is the sequence in Microsoft’s WinRE startup troubleshooting guide, which also runs CHKDSK /f D: first and says to repeat the SFC step if DISM finds and fixes something. If the offline repair cannot find good files, give it a source. Microsoft’s syntax for an offline image is:

Dism /Image:D:\ /Cleanup-Image /RestoreHealth /Source:wim:E:\sources\install.wim:1

where E: is the drive letter of the install media as WinRE sees it. SFC takes /offbootdir (the offline boot directory), /offwindir (the offline Windows directory) and, if you want the log somewhere other than the default, /offlogfile.

If it still fails

  • Run DISM again, then SFC again, after a restart. A second pass often finishes what the first started.
  • Scan in Safe Mode if SFC says it could not perform the operation. Microsoft recommends it for that message.
  • Check the disk. Repeated corruption can mean a failing drive or file system errors. Run chkdsk on the system volume and check the drive’s health with the manufacturer’s tool.
  • Replace a single unrepaired file by hand, as a last step. Microsoft documents taking ownership and copying a known-good copy from another PC running the same version of Windows. This is advanced, can break the PC if you pick the wrong file, and should only be done with the file named in CBS.log. The steps are takeown /f <file>, then icacls <file> /grant administrators:F, then copy the good file over it.
  • Reinstall or repair Windows. If none of that works, Microsoft’s SFC article says you may need to reinstall Windows, and points to its recovery options page. [UNCONFIRMED: keeping files and apps with an in-place repair upgrade. This is widely used, but we did not check it against Microsoft documentation for this article. Check the recovery options page for what applies to your version.]

Replacing a file by hand changes its permissions and ownership. Do it only for the specific file CBS.log names, and keep a copy of the original. Microsoft suggests getting the good copy from another computer on the same version of Windows, and running SFC on that computer first to make sure the copy is good.

Verification

  • sfc /scannow ends with “Windows Resource Protection did not find any integrity violations.”
  • DISM.exe /Online /Cleanup-Image /CheckHealth reports the image as healthy, not repairable or non-repairable.
  • The thing that sent you here works again: the update installs, the feature or role installs, or the crash has gone. This is the real test, so try it, not only the scans.
  • No Cannot repair member file lines are dated after your last run in the findstr extract.

Notes

  • Why this works: the component store is the source of truth that SFC repairs from. DISM fixes the store first, using Windows Update or your own source, and SFC then makes the running files match it.
  • Windows Server: the same two commands apply. Microsoft’s guidance for failed roles and features says to run Dism /Online /Cleanup-Image /RestoreHealth, check CBS.log, and then run SFC /scannow. By default DISM uses Windows Update as the source. On a server that does not reach it, or on a PC managed by Group Policy, the repair source is set by the policy Specify settings for optional component installation and component repair (Computer Configuration, Administrative Templates, System). The same Microsoft page describes the repair source options.
  • Which source form to use: Microsoft’s pages show the WIM source in two ways. The repair source page uses the wim: prefix with an index, which this article follows. One Azure troubleshooting page shows a plain path to install.wim without a prefix or index. [UNCONFIRMED: whether both forms behave the same on every Windows build. Use the wim: form shown here, which is the documented syntax.]
  • Do not use registry cleaners or third-party “repair” tools for this. Everything needed is in Windows.

Microsoft sources used (checked 14 October 2026):

Still stuck? Post the exact DISM or SFC message and the [SR] lines around any Cannot repair member file entry from CBS.log in The Patch Panel and we will read it with you. The best answer earns points on Top of the Stack.

Was this helpful?

Updated on October 14, 2026