Corrupt Windows system files most often result from interrupted updates, sudden power loss, or failing disk sectors that leave protected operating system files damaged or incomplete. Corrupt system files cause application crashes, blue screen errors, failed Windows updates, and missing features that no setting can restore. Windows includes two built-in command-line tools that repair this damage: System File Checker, run as sfc /scannow, and the Deployment Image Servicing and Management tool, run as DISM.
This article explains what corrupt system files cause, how each tool works, and the exact order in which to run them. The correct sequence is DISM CheckHealth, ScanHealth, and RestoreHealth first, then sfc /scannow, because DISM repairs the component store that System File Checker relies on for clean replacements. It also covers reading CBS.log, running both tools from the Windows Recovery Environment when Windows will not boot, and using chkdsk for disk-level corruption.
What Do Corrupt System Files Cause?
Corrupt system files cause failures across Windows because protected operating system files are replaced, deleted, or left incomplete. The problems below are the most common results of system file corruption.
- Application and system crashes. A program that depends on a damaged system DLL closes unexpectedly or fails to start.
- Blue screen of death errors. A corrupted driver or kernel file triggers a stop error and forces a restart.
- Failed Windows updates. The update installer aborts when a required component file is missing, returning codes such as 0x800f0922.
- Missing or broken features. The Start menu, search, or a Windows component stops responding when its files are damaged.
- Boot failures. Corruption in core startup files can leave Windows unable to load, requiring repair from the Recovery Environment.
Corruption that produces these symptoms is repaired by the two tools below. Persistent damage after both tools complete points to a failing disk, which chkdsk diagnoses.
How System File Checker Works
System File Checker scans every protected Windows file, compares each against a known good copy in the component store, and replaces any file that is corrupted or modified. The tool runs from an elevated Command Prompt as sfc /scannow.
System File Checker verifies the integrity of protected files such as system DLLs, drivers, and core executables. When it finds a damaged file, it pulls a clean copy from the local component store, also called WinSxS, and overwrites the bad file.
Because System File Checker depends entirely on that store for replacements, a corrupted store leaves it unable to repair the files it identifies. DISM repairs the store, which is why DISM runs first.
- Type cmd in Windows Search, right-click Command Prompt, and select Run as administrator.
- Run sfc /scannow and leave the window open until verification reaches 100 percent.
- Read the result message, which reports whether corrupt files were found and repaired.
- Restart the computer if files were repaired.
- Run sfc /scannow a second time to confirm no integrity violations remain.
A result reading that Windows Resource Protection found corrupt files and repaired them confirms success. A result reading that it could not fix some files means the component store is damaged and DISM must run.
How DISM Works
DISM services the Windows image and repairs the component store that System File Checker relies on, downloading clean replacement files from Windows Update when the local store is damaged. The tool runs from an elevated Command Prompt with three progressive options.
The Deployment Image Servicing and Management tool inspects and repairs the online Windows image, meaning the running installation. CheckHealth performs a quick check for recorded corruption. ScanHealth performs a deeper scan of the component store.
RestoreHealth repairs any corruption it finds, using Windows Update as the source of clean files by default. Because DISM restores the store that System File Checker draws on, running DISM before System File Checker gives the second tool a clean source for replacements.
- Open Command Prompt as administrator.
- Run DISM /Online /Cleanup-Image /CheckHealth for a quick corruption check.
- Run DISM /Online /Cleanup-Image /ScanHealth for a full component store scan.
- Run DISM /Online /Cleanup-Image /RestoreHealth to repair the store from Windows Update.
- Wait for RestoreHealth to reach 100 percent, which can pause near 20 percent.
A stable internet connection is required for RestoreHealth to download replacement files. When Windows Update is unavailable, point DISM to a known good install.wim with the /Source parameter and add /LimitAccess to prevent it from contacting Windows Update.
Run DISM and SFC in the Correct Order
Running DISM RestoreHealth before sfc /scannow is the correct order, because DISM repairs the component store that System File Checker uses as its source of clean files. Reversing the order leaves System File Checker without a healthy source if the store itself is damaged.
- Open Command Prompt as administrator.
- Run DISM /Online /Cleanup-Image /CheckHealth.
- Run DISM /Online /Cleanup-Image /ScanHealth.
- Run DISM /Online /Cleanup-Image /RestoreHealth and wait for it to finish.
- Run sfc /scannow to repair protected files using the now-clean store.
- Restart the computer and run sfc /scannow once more to confirm a clean result.
This sequence repairs both layers of Windows file protection in one pass. The component store is repaired first, then the protected system files that depend on it, which resolves most corruption that a single tool cannot.
Read CBS.log to See What Was Repaired
Reading the CBS.log file shows exactly which files System File Checker found corrupted and whether each was repaired, which is necessary when sfc reports it could not fix some files. The log records every action with a timestamp.
- Open Command Prompt as administrator.
- Run findstr /c:”[SR]” %windir%\Logs\CBS\CBS.log > “%userprofile%\Desktop\sfcdetails.txt”.
- Open the sfcdetails.txt file created on the Desktop.
- Read the entries marked Cannot repair member file to identify unrepaired files.
- Note the file names listed so the correct component or update can be reinstalled.
The filtered log isolates the System File Checker entries from the larger CBS.log. Files listed as cannot be repaired usually belong to an optional component or a specific update that can be reinstalled to restore the clean copy.
Run SFC and DISM from Windows Recovery
Running System File Checker and DISM from the Windows Recovery Environment repairs corruption when Windows will not boot, by targeting the offline installation from a Command Prompt outside the operating system. The offline commands use different parameters than the online versions.
- Force three failed boots to trigger the Recovery Environment, or boot from Windows installation media and select Repair your computer.
- Open Troubleshoot, then Advanced options, then Command Prompt.
- Identify the Windows drive letter, which is often D in Recovery, using diskpart or dir.
- Run sfc /scannow /offbootdir=C:\ /offwindir=D:\Windows with the correct letters.
- Run DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:E:\Sources\install.wim to repair the offline image from media.
The offline parameters tell each tool where the boot files and the Windows folder reside, since drive letters differ inside Recovery. This procedure repairs a system too damaged to start normally. A computer that hangs before this point is covered by the guide to a Windows installation stuck on the loading screen.
Run chkdsk for Disk-Level Corruption
Running chkdsk repairs disk-level corruption that System File Checker and DISM cannot reach, by scanning the file system and the physical sectors that store the files. Bad sectors on a failing drive recreate corruption even after the system file tools succeed.
- Open Command Prompt as administrator.
- Run chkdsk C: /f /r to fix file system errors and recover readable data from bad sectors.
- Type Y to schedule the scan at the next restart when prompted that the volume is in use.
- Restart the computer and let chkdsk complete before Windows loads.
- Run sfc /scannow again after chkdsk finishes to repair any files the disk damaged.
Repeated corruption after a clean chkdsk and SFC pass indicates a failing drive that needs replacement. The reliability difference between drive types is set out in the comparison of HDD versus SSD storage.
SFC and DISM Symptoms and Correct Tool
| Symptom or Message | Most Likely Cause | Correct Tool or Step |
|---|---|---|
| sfc reports it repaired corrupt files | Damaged protected files | sfc /scannow, then verify |
| sfc cannot fix some files | Corrupted component store | DISM RestoreHealth, then sfc |
| DISM RestoreHealth fails to download | No Windows Update access | Use /Source and /LimitAccess |
| Windows will not boot | Core startup file corruption | Run both tools from Recovery |
| Corruption returns after repair | Failing disk or bad sectors | Run chkdsk C: /f /r |
| Need to confirm what was repaired | Unclear sfc result | Read CBS.log entries |
Key Takeaways
- Run DISM before SFC. DISM repairs the component store that System File Checker uses as its source of clean files.
- Use all three DISM stages. CheckHealth, ScanHealth, and RestoreHealth progress from a quick check to a full repair.
- Read CBS.log when files cannot be fixed. The filtered log names the unrepaired files so the right component can be reinstalled.
- Repair offline from Recovery when Windows will not boot. The offline parameters target the installation from outside it.
- Run chkdsk for returning corruption. Disk-level damage recreates file corruption that the system file tools cannot prevent.
Should I run SFC or DISM first?
Run DISM first. DISM /Online /Cleanup-Image /RestoreHealth repairs the component store, then sfc /scannow uses that clean store to repair protected files. Running DISM first gives SFC a healthy source.
What does sfc /scannow do?
System File Checker scans all protected Windows files, compares each against a clean copy in the component store, and replaces any file that is corrupted or modified, then reports what it repaired.
What does DISM RestoreHealth do?
DISM RestoreHealth scans the Windows component store for corruption and repairs it using clean files downloaded from Windows Update, restoring the source that System File Checker depends on.
Where is the SFC log file?
System File Checker writes to CBS.log in the Windows\Logs\CBS folder. Filter it with findstr for the [SR] tag to see only the System File Checker entries and which files were repaired.
How do I run SFC if Windows will not boot?
Boot into the Windows Recovery Environment, open Command Prompt, and run sfc /scannow /offbootdir=C:\ /offwindir=D:\Windows, using the correct offline drive letters for your system.
Why does corruption keep coming back after SFC?
Returning corruption usually means a failing disk. Bad sectors recreate damaged files. Run chkdsk C: /f /r to repair the file system, and replace the drive if errors persist.
Last Thoughts on Repairing Corrupt System Files
Corrupt system files are repaired by running DISM RestoreHealth to fix the component store, then sfc /scannow to repair the protected files that depend on it, in that order. Reading CBS.log confirms which files were fixed, the Recovery Environment handles a system that will not boot, and chkdsk addresses the disk-level damage that recreates corruption.
These two tools resolve the file damage behind Windows Update errors and many stop errors, which is why they appear throughout the list of common PC problems. A system that fails to power off correctly after repairs is covered by the guide to a PC that will not shut down, and the role of these protected files within the wider system is explained in the overview of what an operating system is.
