In this episode, I will show you how to check the integrity of Windows 10 system files, and if they are damaged, I will show you how to restore these files using the SFC and DISM commands.
No user is immune from errors in the Windows 10 operating system. They can arise due to its purposeful or accidental interference with the operation of the OS, as well as due to the fault of third-party applications. If the operating system begins to complain about missing files, registry errors, or the inability to read items from the Windows folder, you will need to check the integrity of its components.
The Windows 10 operating system provides 2 methods for analyzing file integrity - through the SFC.exe and DISM.exe . The commands do not replace each other, but complement each other, checking various system libraries for file integrity. That is why it is recommended to do not one of them, but both. The tools will allow you to check the integrity of Windows 10 files and replace damaged or modified elements with original ones.
Please note that if you or the Computer Administrator previously specifically made changes to the system files of the operating system, they will be canceled. Windows tools will replace the changed items with the original ones, even if the problem with your computer or application is not caused by their actions.
SFC /scannow: Windows system file recovery
Before restoring a Windows image using DISM, it is recommended that you first try checking the integrity of system files using the SFC (System File Checker) utility. The sfc /scannow command allows you to check the integrity of Windows system files. If any system files are missing or damaged, the SFC utility will try to restore their original copies from the Windows System Component Store (C:\Windows\WinSxS directory).
The SFC utility records all its actions in the log file windir%\logs\cbs\cbs.log . All entries left by SFC in the CBS.log file are marked with the [SR] . To select only SFC-related entries from the log, run the command: findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfc.txt"
If the sfc /scannow command returns the error “Windows Resource Protection found corrupt files but was unable to fix some of them,” most likely the utility was unable to retrieve the necessary files from the storage Windows components (image).
In this case, you need to try restoring the component store of your Windows image using DISM.
After restoring the image, you can reuse the SFC utility to restore system files.
Examine the integrity of the system and correct its elements using SFC
The sfc /scannow OS integrity scanning command is popular among experienced users.
It automatically examines and eliminates defects in OS components. SFC operates as an administrator, through the command line, which is opened by right-clicking on the Start menu. Next, enter sfc /scannow and press Enter.
These actions begin a scan of the OS, as a result of which the detected damage is corrected. If there are no errors, the user sees the message “Windows Resource Protection detected no integrity violations.” Another aspect of this study is irreparable damage. Part of the continuation of this article will be devoted to them.
The sfc /scanfile=”path_to_file” command allows you to check for errors in a specific system component.
The disadvantage of the software is that it does not eliminate defects in OS elements used during scanning. The problem is solved by running SFC via the command line in the OS recovery environment. This method is quite effective and involves performing several simple operations.
Checking the integrity of the Windows Component Store using DISM
The DISM (Deployment Image Servicing and Management) utility is available in all versions of Windows, starting with Vista.
To scan a Windows image for errors and fix them, use the DISM /Cleanup-image option. DISM commands must be run from the command line with administrator rights.
To check for a sign of component store corruption in a Windows image (CBS flag), run the command (not applicable to Windows 7/Server 2008R2):
DISM /Online /Cleanup-Image /CheckHealth
This command does not perform a full scan of the component store. Only previously recorded damage markers and events in the Windows log are checked. No changes are made to the image. The command will check to see if your Windows image is marked as corrupt and if it is possible to fix it.
In this example, the command returned that everything was fine with the image:
No component store corruption detected. The operation completed successfully.
To perform a full Component Store scan for corruption in the Windows Component Store, run the command:
DISM /Online /Cleanup-Image /ScanHealth
The Windows image verification command can take quite a long time to complete (from 10 to 30 minutes). And it will return one of three results:
- No component store corruption detected – DISM did not detect corruption in the component store;
- The component store is repairable – DISM has detected errors in the component store and can fix them;
- The component store is not repairable - DISM cannot fix the Windows component store (try using a newer version of DISM or you will have to restore the Windows image from a backup, reset or completely reinstall your copy of Windows.
On Windows 7 and Windows Server 2008 R2, you must install the separate update KB2966583 to use the DISM /ScanHealth option . Otherwise, when you run DISM, you will see “Error 87. The ScanHealth parameter is not recognized in this context.”
The DISM /ScanHealth command may return errors:
- Error: 1726. Remote procedure call failed;
- Error: 1910. The specified object export source was not found.
This clearly indicates that your Windows image is damaged and needs to be restored.
Restoring a Windows image using DISM /RestoreHealth
To fix corruption in the Windows image component store, you need to use the RestoreHealth of the DISM command. This option will allow you to correct errors found in the image, automatically download and replace files of damaged or missing components with reference versions of files from Windows Update (the computer must have Internet access). Run the command:
DISM /Online /Cleanup-Image /RestoreHealth
In Windows 7/2008 R2 this command looks different: DISM.exe /Online /Cleanup-Image /ScanHealth
The process of scanning and restoring components can be quite lengthy (30 minutes or more). DISM will automatically download missing or corrupt image files from Windows Update servers.
The restoration was completed successfully. The operation was completed successfully. The restore operation completed successfully.
DISM /Source: Recovering a Windows image from an installation disk
If the computer (server) does not have access to the Internet or the Windows Update service is disabled/damaged (how to restore the Windows Update client), then errors will appear when restoring the component store:
- 0x800f0906 - Failed to download source files. Specify the location of the files required to restore the feature using the Source option (0x800f0906 - The source files could not be downloaded. Use the source option to specify the location of the files that are required to restore the feature);
- Error: 0x800f0950 - DISM failed. The operation was not performed (0x800f0950 - DISM failed. No operation was performed);
- Error: 0x800F081F . The source files could not be found. Specify the location of the files required to restore the feature using the Source parameter (Error 0x800f081f, The source files could not be found. Use the “Source” option to specify the location of the files that are required to restore the feature).
- Installation disk/flash drive/iso image of Windows
- Mounted wim file
- \sources\SxS folder from the installation disk
- The install.wim file with the Windows installation image
- Error Error: 50: DISM does not support servicing Windows PE with the /Online option , which means your DISM thinks that you are using a WinPE Windows image. To fix this, delete the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT.
You can specify a WIM or ESD file with the original Windows installation image to use as a source for restoring system files. Let's assume you have mounted the Windows 11 installation ISO image into the D: virtual drive.
Note : To restore damaged files in the component store from a local source, the version and edition of Windows in the image must be exactly the same as yours.
Use the following PowerShell command to check which version of Windows is installed on your computer:
Get-ComputerInfo |select WindowsProductName,WindowsEditionId,WindowsVersion, OSDisplayVersion
List the available versions of Windows in the installation image:
Get-WindowsImage -ImagePath "D:\sources\install.wim"
In our case, the Windows 11 Pro image in the install.wim image has ImageIndex = 6.
To restore a component store from a local WIM/ESD file with Internet access blocked, run the following command (don't forget to include your Windows version index in the file):
DISM /online /cleanup-image /restorehealth /source:WIM:D:\sources\install.wim:6 /limitaccess Or: DISM /online /cleanup-image /restorehealth /source:ESD:D:\sources\install.esd :6 /limitaccess
If at startup it appears
Error 87: check the command spelling correctly, make sure you are using the version of DISM for your version of Windows (usually happens when booting via WinPE/WinRE).
The DISM utility writes a detailed log of scanning and repairing system files to the file C:\Windows\Logs\DISM\dism.log.
After the component store has been restored, you can run the system file checker sfc /scannow. Most likely, it will successfully restore damaged files:
Windows Resource Protection detected damaged files and successfully repaired them. Windows Resource Protection found corrupt files and successfully repaired them.
If all system files are intact, a message will appear:
Windows Resource Protection did not find any integrity violations
Examples of using
To immediately scan and repair damaged system files:
sfc /scannow
To check the integrity of a file without fixing it:
sfc /verifyfile=c:\windows\system32\example.dll
Check the example.dll file in the system recovery console from the Windows installation F disk:
sfc /scanfile=d:\windows\system32\example.dll /offbootdir=f:\ /offwindir=d:\windows
Recovering a Windows Image Using PowerShell
The version of PowerShell in Windows 10/11 and Windows Server 2022/2019 has analogues of the DISM commands discussed above. To scan the component store and look for corruption in the image, run:
Repair-WindowsImage -Online –ScanHealth
If no errors are found in the component store, the following message appears:
ImageHealth State: Healthy
To start restoring system components and files, type:
Repair-WindowsImage -Online -RestoreHealth
If there is no Internet access, this command may freeze during the image recovery process. You can restore system components from a local copy of the Windows image in the form of a WIM/ESD file copied from the Windows 10 installation ISO image (here you also need to specify the Windows version index in the wim file as the recovery source):
Repair-WindowsImage -Online -RestoreHealth -Source D:\sources\install.wim:5 –LimitAccess
DISM: Repair corrupted component store if Windows won't boot
If Windows does not boot correctly, you can check and fix system files offline.
If Windows won't boot after installing updates, try uninstalling the latest patches first.
- To do this, boot your computer from the Windows installation image (the easiest way is to create a bootable USB flash drive with Windows 10/11 using the Media Creation Tool) and on the installation start screen, press Shift + F10
- To sort out the drive letters assigned in the WinPE environment, run the command diskpart -> list vol (in my example, the drive on which Windows is installed is assigned the letter C:\, I will use this letter in the following commands);
- Let's check system files and fix damaged files with the command: sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
- To fix the component store, use the following command (as a source for restoring components, we use the WIM file with the Windows 10 installation image from which we booted the computer): Dism /image:C:\ /Cleanup-Image /RestoreHealth /Source:WIM:D :\sources\install.wim:6
- If there is not enough space on the target disk, then to extract temporary files we will need a separate disk of sufficient size, for example F:\, on which we need to create an empty directory: mkdir f:\scratch and start restoring the component store with the command: Dism /image:C:\ /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /ScratchDir:F:\scratch
Advice . Other useful DISM commands that an administrator should know:
Integrity testing using SFC in an OS recovery environment
It does not take much time and does not require special skills. Launching in the OS recovery environment is performed in several ways:
- You need to go to “Settings” and select “Update and security”, “Recovery”, “Custom boot options” and “Restart now” one by one. A simpler method: in the lower right part of the OS login interface, click the “on” tab, after which, while holding “Shift”, you need to click “Reboot”.
- Another option is to boot from a pre-prepared OS recovery disk.
- Another alternative is an electronic medium with an OS distribution. In the installation program, after selecting the language, select “System Restore” in the lower left part.
When finished, you need to enter “Troubleshooting”, select “Advanced options” and click “Command Prompt” (using the first of the previously presented methods requires entering the system administrator password). The following is applied sequentially:
- diskpart
- list volume
Based on the results of running the specified commands, the user sees a list of volumes. It is recommended to remember their designations corresponding to the “System Reserved” drive and the OS partition, since sometimes they differ from those in Explorer.
Next, other commands are entered:
exit
sfc /scannow /offbootdir=F:\ /offwindir=C:\Windows (where F is the “System Reserved” drive specified earlier, and C:\Windows is the path to the OS folder).
The described actions initiate an in-depth investigation of the system's integrity, during which the SFC command fixes all damaged components, without exception. Studying can take a long time. The underscore indicator blinks to indicate that the system is continuing to operate. When finished, the command line closes and the OS reboots in standard mode.
