The system file checker tool is a useful command used to scan and repair corrupt or damaged system files. This command is usually used when users encounter problems with the system files of Windows OS.
sfc /scannow is the most popular command to scan for corrupt system files immediately. It will not only scan, but also try to repair or replace corrupt system files with healthy ones. It requires a Windows installation source to copy files from.
The system file checker is a universal command and can be used in all Windows operating systems, including Windows 11, Windows 10, Windows 8, Windows 7 and Windows Vista.
This command line can perform several functions. We will discuss these in this article.
Table of contents
- SFC Switches
- Running Basic SFC Scan
- Outputs of SFC Scan
- Why SFC Scan Failed
- How to Open SFC CBS.Log File
- How to Fix SFC /ScanNow Failed
- Run Offline SFC ScanNow from WinPE
- Manually Replace Corrupted Files
- Scan Other Non-OS Volumes using SFC
- How to Fix "Windows Resource Protection Could Not Start The Repair Service"
- Frequently Asked Questions
The table below lists all the switches which can be used with the SFC command-line tool, and their functions:
|sfc /scannow||Scan for issues. If found, replace the file from the DLL cache.|
|sfc /scanonce||Will scan only once.|
|sfc /scanboot||Will scan the computer at every boot.|
|sfc /revert||Revert the scanning functionality to its original (default) state.|
|sfc /purgecache||Will remove the Windows File Protection cache and begin a scan over the system files.|
|sfc /cachesize=X||Set the cache size of the Windows File Protection to X MBs.|
|sfc /?||Display help regarding switches.|
Today, we are only going to be focusing on the “sfc /scannow” cmdlet as it is the one that quickly and effectively fixes your operating system.
Running Basic SFC Scan
The simplest (and most convenient) method to run the system file checker command is by running the following cmdlet in an elevated Command Prompt window:
The cmdlet will then perform its job and attempt to repair any protected files that may have been corrupted. However, that is not always the case, and users may encounter different errors from time to time.
Before we discuss these different errors, let us discuss the various outputs of the basic scan and what each of those means.
Outputs of SFC Scan
As you can observe in the image above, the output of the SFC scan states the following:
Windows Resource Protection found corrupted files and successfully repaired them.
It then also states the location of a CBS.log file which contains the details of the performed scan – we’ll get into that a moment later.
Let us now see all the possible outputs of the SFC scan that different users can encounter and what they mean:
|Windows Resource Protection did not find any integrity violations.||No missing or corrupted system files were detected, meaning your system’s integrity is intact.|
|Windows Resource Protection could not perform the requested operation.||An unknown issue occurred and the scan could not be performed. In this case, you must adopt the alternative methods given below in this post.|
|Windows Resource Protection found corrupt files and successfully repaired them.||Missing or corrupted files were found and have been repaired, restoring your system’s integrity.|
|Windows Resource Protection found corrupt files but was unable to fix some of them.||Your system’s integrity was compromised, but SFC did not work. In this case, you must adopt alternative methods to fix the issue or replace the files manually using the given guide further down this post.|
Apart from this, there are other possible issues that you may encounter while performing the scan.
Why SFC Scan Failed
You may encounter any one of the following scenarios while performing an SFC scan. The table below lists those scenarios along with their possible solutions.
Note: The methods to perform these solutions are discussed below.
|Symptom of Failure||Possible Solution|
|Scan stuck at verification||Run the scan in safe mode or replace files manually|
|Scan gets frozen at a certain percentage||First run the DISM tool and then run the SFC scan in safe mode.|
|Nothing happens when running “sfc /scannow”||Run the DISM tool first and then run the SFC scan in safe mode.|
|SFC scan completely stops||Disable Intel Turbo Memory and try rerunning the scan.|
|SFC scan cannot fix the problem||First run the DISM tool and then run the SFC scan in safe mode.|
|Scan requires administrative privileges||Run the scan from an administrator account with an elevated Command Prompt.|
Before we discuss the different methods to run the SFC scan, bypassing any issues, let us look at the log file generated when an SFC scan is executed.
How to Open SFC CBS.Log File
When you perform an SFC scan, the system automatically generates a log file named “CBS.log.” This file contains information on the scan that was executed, which can help you advanced troubleshoot if you encounter an issue with the SFC tool.
The CBS.Log file is saved at the following location:
You can open this log file using a text editor, such as Notepad, Word, Wordpad, etc.
Follow these steps to open the file:
Navigate to the following location using File Explorer:
Here, right-click the file “CBS” then click Open with from the context menu.
Now select the program you want to open the text file with from the popup and click Ok.
The log file will then open in the text editor.
Since the CBS.Log file can be lengthy, you can analyze it using the Find function. You can look for keywords in the entire file using the CTRL + F shortcut keys, and then use the following keywords to look for the details on the file that may have been repaired, not repaired, corrupted, etc. Here is a list of the keywords you can use and the respective features you can find.
|Repaired||View files that were repaired|
|Cannot repair||View files SFC failed to repair – Will need to be replaced manually|
|Corrupt||Files that are or were corrupted – Will need to be replaced manually|
By analyzing the CBS.Log file, you can pinpoint the files which SFC could not repair, and then replace those files manually using the guide given down below.
How to Fix SFC /ScanNow Failed
If you are not able to fix your operating system using the basic approach for running the SFC scan, then there is still plenty you can do to mitigate the problem.
Note: The steps given below need to be performed in a methodical order as given.
Scan Hard Drive
To begin, you first need to scan your hard drive for errors or bad sectors using the Check Disk (CHKDSK) utility, since those could prevent the SFC scan from performing a successful repair. Here is how to do it:
Run the following cmdlet:
Chkdsk C: /f /r /x
You will be asked to schedule the CHKDSK utility the next time the computer reboots. Enter Y for yes.
Now restart your computer. Once it reboots, the Check Disk utility will run and scan your hard drive. This can take a while, in some cases, hours. Let the scan finish and reboot into Windows.
Enable Built-In Administrator Account
Now enable the built-in Administrator account, which will be needed by following the steps below. Using this account, you will have elevated privileges required to manipulate protected files.
There are several ways to enable the built-in Administrator account on a Windows computer. Click here to learn more about them.
Reboot in Safe Mode
Safe Mode is a diagnostic mode that starts Windows in a basic state, loading a limited set of files and drivers. This is intended for troubleshooting Windows problems.
Perform these steps to boot into Safe Mode with Networking – which means you will have access to the internet which is then later required to run the DISM utility.
Open the System Configuration applet by typing in msconfig in the Run Command box.
Switch to the Boot tab. Here, in the Boot options section, check the box next to “Safe Boot,” and then select the Network radio button under it. Once done, click Apply and Ok.
In the confirmation dialog box, click Restart.
Your computer will now reboot into Safe Mode.
Learn other methods to boot into Safe Mode.
Log In From Built-In Administrator Account
Now you must log in to the Administrator account that you enabled earlier. This will allow you to have the privileges to repair missing or corrupted system files.
Run DISM Utility
Once you are logged in, you must first run the DISM utility to fix the system image. Fixing the system image will then allow the SFC scan to perform its task without any hindrance.
The DISM tool can be used to prepare, modify, and repair system images. However, you need an active internet connection to download and replace corrupted content from Windows Update, which is why we opted to boot into Safe Mode with internet connectivity.
Follow these steps to run the DISM utility:
Launch the Command Prompt with administrative privileges.
Now execute the following cmdlets one after the other, allowing each cmdlet sufficient time to complete.
DISM.exe /Online /Cleanup-image /Checkhealth DISM.exe /Online /Cleanup-image /Scanhealth DISM.exe /Online /Cleanup-image /Restorehealth
Once this is done successfully, do not close the Command Prompt.
Run SFC ScanNow
Now all you need to do is run the basic SFC scan in an attempt to repair the operating system and the corrupted files within. Run the following cmdlet in an elevated Command Prompt:
That is it! This method should eliminate any issues you experience while performing the SFC scan in basic mode. Restart the computer once the scan is complete.
However, if you find the SFC utility is still unable to fix missing or corrupted files, there are still several things you can do. To begin, we suggest you analyze the CBS.Log file, as we discussed earlier in this post.
Run Offline SFC ScanNow from WinPE
The offline version of the SFC scan means that you run the scan from the Windows Preinstallation Environment (WinPE). This method can be especially useful if you are unable to boot into Windows.
This process requires a Windows installation device (DVD, bootable USB) that has the same OS version as installed.
Perform the following steps to attempt and repair any missing or corrupted system files using the SFC scan with WinPE.
Plugin the bootable device and boot from it.
On the first screen, click Next.
Now click Repair your computer.
Now select Troubleshoot.
Now select Command Prompt.
The Command Prompt will now open in front of you. Paste the following cmdlet to verify the drive letter assigned to the volume where Windows is installed.
Note down the drive letter beneath “Windows Boot Loader” in front of device.
Note: Since the drive letters assigned in WinPE are not the same as the default drive letters you see when Windows is booted, these can be different for everyone. Therefore, it is important to determine which drive letter is currently assigned to the boot volume.
Now use the following cmdlet to run the SFC scan here, while replacing DriveLetter (in 2 places) with the letter of the drive where Windows is installed as noted in the last step:
sfc /scannow /offbootdir=DriveLetter: /offwindir=DriveLetter:\Windows
Once the scan is complete, restart your computer and boot normally into Windows.
If this does not work for you either, you can manually replace the corrupted files yourself.
Manually Replace Corrupted Files
At this point, you must have already analyzed the VBS.Log file we had discussed earlier. Using the file names determined from there, you can manually replace them with healthy files obtained from another computer. Here is how to do it:
Start by taking ownership of the corrupted system file. To do so, run the following cmdlet in an elevated Command Prompt while replacing Path&FileName with the complete path and file name of the corrupted file:
takeown /f Path&FileName
Next, grant the Administrators group full access to the file using the following cmdlet while replacing Path&FileName as earlier:
icacls Path&FileName /GRANT ADMINISTRATORS:F
Now you should be able to easily replace the file with another copy. At this point, copy the same file from a healthy computer having the same Windows version and paste it here, replacing the current one.
That is it! You can now repeat the same process to manually replace any corrupted files.
Scan Other Non-OS Volumes using SFC
It may be possible that you are running more than one operating system on your PC, and not all of them can be in the same drive (usually the C drive). In that case, you must direct the SFC scan to attempt and repair another drive.
Furthermore, you can also direct it to scan external drives, such as USB flash drives, SD cards, etc.
Here is how to do so:
Note: Since SFC can only fix missing and corrupted files, it can only attempt to repair drives with a Windows operating system in it.
Now use the following cmdlet to scan another drive while replacing DriveLetter with the drive letter for the volume you want to scan:
The scan will now attempt to repair any corrupted or missing files that you selected other than the C drive.
How to Fix “Windows Resource Protection Could Not Start The Repair Service”
It may be possible that you encounter the following error while trying to run an SFC scan on your computer:
Windows Resource Protection could not start the repair service
If so, here are a few things you can do to mitigate this issue:
Start Dependency Service
It may be possible that a dependency service named “Windows Modules Installer (Trusted Installer)” isn’t running on your computer, preventing the scan from happening. In that case, the service needs to be enabled.
Open the Services console by typing in services.msc in the Run Command box.
Here, scroll down and right-click on the service “Windows Modules Installer” and then click Properties from the context menu.
From the popup, select “Startup Type” as Automatic, then click Start. When the service starts, click Apply and Ok to save the changes.
Try rerunning the SFC scan.
Learn other methods to enable and disable Windows services.
Disable Turbo Memory
Intel Turbo Memory is a feature that allows NAND memory modules to power up, access programs, and write data on the hard drive much quicker than usual. This feature can be controlled through the system BIOS.
If you experience an SFC scan suddenly stops or cannot complete its job, then you must disable Turbo Memory from the BIOS settings.
Learn how to access BIOS.
Modify Security Descriptors
A Security Descriptor contains security information that may be associated with a securable object. It may be possible that critical Security Descriptors may have corrupted in the WinSXS folder where critical files are stored.
To mitigate this issue, perform the following task:
Now run the following cmdlet:
Now restart your computer and try rerunning the SFC scan.
Other Mitigation Methods
If you encounter the said error, there are other things you can also perform which we have already discussed above in this post. Here is a list of additional steps you can take:
- Run Check Disk Utility.
- Run DISM utility.
- Run SFC scan in Safe Mode.
- Replace corrupted files manually.
Frequently Asked Questions
Does SFC ScanNow fix anything?
Short answer: Yes, it does. However, the SFC tool itself can occasionally encounter errors, which are also fixable.
How to run SFC scan?
Run the following cmdlet in the Command Prompt:
Is the SFC scan safe?
Yes, the SFC scan is completely safe. In fact, you can even run it if nothing is wrong with your computer, just to ensure your device’s integrity.
What does SFC ScanNow actually do?
The SFC ScanNow cmdlet scans all protected files and replaces corrupted files with a cached copy that has been kept in its original shape.
Can you exit SFC scannow?
Yes, it is safe to cancel the scan. However, we do suggest that you allow it to be completed as it causes no harm. If you find that it is stuck you can cancel it using the CTRL + C keys simultaneously.
Does SFC ScanNow improve performance?
If the scan is able to fix critical files, it can sometimes improve the system’s overall performance and speed since the protected files are now as they should be.
Can SFC ScanNowfix BSoDs?
Potentially, yes. BSoDs are often caused by corrupted or missing files, and this is the one thing SFC is good at.