How to Repair Corrupt System Files with SFC and DISM

Corrupt Windows system files most often result from interrupted updates, sudden power loss, malware, or failing disk sectors that leave protected operating system files damaged or incomplete. Corrupt system files cause application crashes, blue screen errors, failed Windows updates, and missing features that no setting can restore. Windows includes two built-in command-line tools that repair this damage: System File Checker, run as sfc /scannow, and the Deployment Image Servicing and Management tool, run as DISM.

What Causes Corrupt System Files?

Corrupt system files are caused by anything that interrupts a write to a protected Windows file or damages the disk it sits on. The four causes below account for most cases.

Corruption from any of these causes is repaired by the two tools below. Persistent damage after both tools complete points to a failing disk, which is why chkdsk is the next step and a hardware replacement is sometimes the real fix. These same root causes drive the broader list of common PC problems.

How Do You Repair Corrupt System Files?

Repair corrupt system files by working through five steps in order, starting with DISM to fix the component store and ending with an in-place repair install only if nothing else works.

• Run DISM RestoreHealth. Open Command Prompt as administrator and run DISM /Online /Cleanup-Image /RestoreHealth. This repairs the component store from Windows Update and can pause near 20 percent before it finishes.
• Run sfc /scannow. With the store now clean, run sfc /scannow so System File Checker can replace any damaged protected files from a healthy source.
• Re-run SFC after a restart. Restart the computer and run sfc /scannow once more to confirm no integrity violations remain.
• Run chkdsk for disk corruption. If corruption returns, run chkdsk C: /f /r to fix file system errors and recover data from bad sectors, then run sfc /scannow again.
• Do an in-place repair install. As a last resort, run an in-place upgrade that replaces every system file while keeping your files, apps, and settings.

How System File Checker Works

System File Checker scans every protected Windows file, compares each against a known good copy in the component store, and replaces any file that is corrupted or modified. The tool runs from an elevated Command Prompt as sfc /scannow.

System File Checker verifies the integrity of protected files such as system DLLs, drivers, and core executables. When it finds a damaged file, it pulls a clean copy from the local component store, also called WinSxS, and overwrites the bad file. Because it depends entirely on that store for replacements, a corrupted store leaves it unable to repair the files it identifies, which is why DISM runs first.

1. Type cmd in Windows Search, right-click Command Prompt, and select Run as administrator.
2. Run sfc /scannow and leave the window open until verification reaches 100 percent.
3. Read the result message, which reports whether corrupt files were found and repaired.
4. Restart the computer if files were repaired.
5. Run sfc /scannow a second time to confirm no integrity violations remain.

A result reading that Windows Resource Protection found corrupt files and repaired them confirms success. A result reading that it could not fix some files means the component store is damaged and DISM must run. SFC is also the tool that resolves the file damage behind many a blue screen of death.

How DISM Works

DISM services the Windows image and repairs the component store that System File Checker relies on, downloading clean replacement files from Windows Update when the local store is damaged. The tool runs from an elevated Command Prompt with three progressive options.

The Deployment Image Servicing and Management tool inspects and repairs the online Windows image, meaning the running installation. CheckHealth performs a quick check for recorded corruption. ScanHealth performs a deeper scan of the component store. RestoreHealth repairs any corruption it finds, using Windows Update as the source of clean files by default.

1. Open Command Prompt as administrator.
2. Run DISM /Online /Cleanup-Image /CheckHealth for a quick corruption check.
3. Run DISM /Online /Cleanup-Image /ScanHealth for a full component store scan.
4. Run DISM /Online /Cleanup-Image /RestoreHealth to repair the store from Windows Update.
5. Wait for RestoreHealth to reach 100 percent, which can pause near 20 percent.

A stable internet connection is required for RestoreHealth to download replacement files. When Windows Update is unavailable, point DISM to a known good install.wim with the /Source parameter and add /LimitAccess to prevent it from contacting Windows Update. A failed update that returns codes such as 0x800f0922 is covered in the guide to Windows Update errors.

Run DISM and SFC in the Correct Order

Running DISM RestoreHealth before sfc /scannow is the correct order, because DISM repairs the component store that System File Checker uses as its source of clean files. Reversing the order leaves System File Checker without a healthy source if the store itself is damaged.

1. Open Command Prompt as administrator.
2. Run DISM /Online /Cleanup-Image /CheckHealth.
3. Run DISM /Online /Cleanup-Image /ScanHealth.
4. Run DISM /Online /Cleanup-Image /RestoreHealth and wait for it to finish.
5. Run sfc /scannow to repair protected files using the now-clean store.
6. Restart the computer and run sfc /scannow once more to confirm a clean result.

This sequence repairs both layers of Windows file protection in one pass. The component store is repaired first, then the protected system files that depend on it, which resolves most corruption that a single tool cannot. A stop error such as critical process died often clears once both layers are repaired.

Read CBS.log to See What Was Repaired

Reading the CBS.log file shows exactly which files System File Checker found corrupted and whether each was repaired, which is necessary when sfc reports it could not fix some files. The log records every action with a timestamp.

1. Open Command Prompt as administrator.
2. Run findstr /c:”[SR]” %windir%\Logs\CBS\CBS.log > “%userprofile%\Desktop\sfcdetails.txt”.
3. Open the sfcdetails.txt file created on the Desktop.
4. Read the entries marked Cannot repair member file to identify unrepaired files.
5. Note the file names listed so the correct component or update can be reinstalled.

The [SR] tag marks the System Resource lines that System File Checker writes, so filtering for it isolates the SFC activity from the much larger volume of general servicing entries. Files listed as cannot be repaired usually belong to an optional component or a specific update that can be reinstalled to restore the clean copy.

Run SFC and DISM from Windows Recovery

Running System File Checker and DISM from the Windows Recovery Environment repairs corruption when Windows will not boot, by targeting the offline installation from a Command Prompt outside the operating system. The offline commands use different parameters than the online versions.

1. Force three failed boots to trigger the Recovery Environment, or boot from Windows installation media and select Repair your computer.
2. Open Troubleshoot, then Advanced options, then Command Prompt.
3. Identify the Windows drive letter, which is often D in Recovery, using diskpart or dir.
4. Run sfc /scannow /offbootdir=C:\ /offwindir=D:\Windows with the correct letters.
5. Run DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:E:\Sources\install.wim to repair the offline image from media.

The offline parameters tell each tool where the boot files and the Windows folder reside, since drive letters differ inside Recovery. This procedure repairs a system too damaged to start normally. A computer that hangs before this point is covered by the guide to a Windows installation stuck on the loading screen.

Run chkdsk for Disk-Level Corruption

Running chkdsk repairs disk-level corruption that System File Checker and DISM cannot reach, by scanning the file system and the physical sectors that store the files. Bad sectors on a failing drive recreate corruption even after the system file tools succeed.

1. Open Command Prompt as administrator.
2. Run chkdsk C: /f /r to fix file system errors and recover readable data from bad sectors.
3. Type Y to schedule the scan at the next restart when prompted that the volume is in use.
4. Restart the computer and let chkdsk complete before Windows loads.
5. Run sfc /scannow again after chkdsk finishes to repair any files the disk damaged.

The /f flag fixes logical file system errors and /r adds a scan for bad sectors with recovery of readable data, so chkdsk C: /f /r covers both. Repeated corruption after a clean chkdsk and SFC pass indicates a failing drive that needs replacement. The reliability difference between drive types is set out in the comparison of HDD versus SSD storage.

Repair Windows with an In-Place Upgrade

An in-place upgrade repair install is the last resort when SFC, DISM, and chkdsk all fail, because it replaces every Windows system file while keeping your files, installed apps, and settings. It reinstalls the same version of Windows over itself rather than wiping the drive.

1. Open Settings, then System, then Recovery.
2. Under Fix problems using Windows Update, select Reinstall now to download and reinstall the current version while keeping everything in place.
3. If that option is unavailable, download a Windows ISO that matches your edition and language and double-click it to mount it.
4. Run setup.exe from the mounted ISO inside Windows, not from a boot menu.
5. Choose Keep personal files and apps when prompted, then let the upgrade complete.

Free at least 20 GB of disk space and pause any third-party antivirus before you start. A repair install rebuilds the component store and every protected file at once, so it fixes corruption that the targeted tools cannot, without the data loss of a clean reinstall.

SFC and DISM Symptoms and Correct Tool

Last Thoughts on Corrupt System Files

Corrupt system files are repaired by running DISM RestoreHealth to fix the component store, then sfc /scannow to repair the protected files that depend on it, in that order. The order matters because System File Checker only copies clean files out of the store that DISM is responsible for repairing, so a reversed sequence leaves SFC without a healthy source. Reading CBS.log confirms which files were fixed, the Recovery Environment handles a system that will not boot, and chkdsk addresses the disk-level damage that recreates corruption.

When even those tools cannot clear the damage, an in-place upgrade repair install rebuilds every system file while keeping your data. These two command-line tools resolve the file damage behind Windows Update errors and many stop errors, which is why they appear throughout the list of common PC problems. A system that fails to power off correctly after repairs is covered by the guide to a PC that will not shut down, and the role of these protected files within the wider system is explained in the overview of what an operating system is.

Key Takeaways:

• Run DISM /Online /Cleanup-Image /RestoreHealth first, then sfc /scannow, because DISM repairs the store that SFC pulls clean files from.
• Use all three DISM stages: CheckHealth, ScanHealth, and RestoreHealth progress from a quick check to a full repair.
• A sfc result of cannot fix some files means the component store is damaged, so run DISM and then SFC again.
• Read CBS.log filtered by the [SR] tag to see exactly which files were repaired or could not be fixed.
• Run chkdsk C: /f /r when corruption returns, since bad sectors recreate file damage the system tools cannot prevent.
• Use an in-place upgrade repair install as the last resort; it replaces every system file while keeping your files, apps, and settings.

Frequently Asked Questions (FAQs)