How To Run SFC /SCANNOW To Repair Windows System Files

SFC SCANNOW Command promptSFC SCANNOW Command prompt

The system file checker tool is a useful command used to scan and repair corrupt or damaged system files. This command is usually used when users encounter problems with the system files of Windows OS.

sfc /scannow is the most popular command to scan for corrupt system files immediately. It will not only scan, but also try to repair or replace corrupt system files with healthy ones. It requires a Windows installation source to copy files from.

The system file checker is a universal command and can be used in all Windows operating systems, including Windows 11, Windows 10, Windows 8, Windows 7 and Windows Vista.

This command line can perform several functions. We will discuss these in this article.

SFC Switches

The table below lists all the switches which can be used with the SFC command-line tool, and their functions:

CommandsFunction
sfc /scannowScan for issues. If found, replace the file from the DLL cache.
sfc /scanonceWill scan only once.
sfc /scanbootWill scan the computer at every boot.
sfc /revertRevert the scanning functionality to its original (default) state.
sfc /purgecacheWill remove the Windows File Protection cache and begin a scan over the system files.
sfc /cachesize=XSet the cache size of the Windows File Protection to X MBs.
sfc /?Display help regarding switches.
SFC switches and their function

Today, we are only going to be focusing on the “sfc /scannow” cmdlet as it is the one that quickly and effectively fixes your operating system.

Running Basic SFC Scan

The simplest (and most convenient) method to run the system file checker command is by running the following cmdlet in an elevated Command Prompt window:

sfc /scannow
sfc
Running basic SFC scan

The cmdlet will then perform its job and attempt to repair any protected files that may have been corrupted. However, that is not always the case, and users may encounter different errors from time to time.

Before we discuss these different errors, let us discuss the various outputs of the basic scan and what each of those means.

Outputs of SFC Scan

As you can observe in the image above, the output of the SFC scan states the following:

Windows Resource Protection found corrupted files and successfully repaired them.

It then also states the location of a CBS.log file which contains the details of the performed scan – we’ll get into that a moment later.

Let us now see all the possible outputs of the SFC scan that different users can encounter and what they mean:

Output StatementMeaning
Windows Resource Protection did not find any integrity violations.No missing or corrupted system files were detected, meaning your system’s integrity is intact.
Windows Resource Protection could not perform the requested operation.An unknown issue occurred and the scan could not be performed. In this case, you must adopt the alternative methods given below in this post.
Windows Resource Protection found corrupt files and successfully repaired them.Missing or corrupted files were found and have been repaired, restoring your system’s integrity.
Windows Resource Protection found corrupt files but was unable to fix some of them.Your system’s integrity was compromised, but SFC did not work. In this case, you must adopt alternative methods to fix the issue or replace the files manually using the given guide further down this post.
SFC outputs and their meanings

Apart from this, there are other possible issues that you may encounter while performing the scan.

Why SFC Scan Failed

You may encounter any one of the following scenarios while performing an SFC scan. The table below lists those scenarios along with their possible solutions.

Note: The methods to perform these solutions are discussed below.

Symptom of FailurePossible Solution
Scan stuck at verificationRun the scan in safe mode or replace files manually
Scan gets frozen at a certain percentageFirst run the DISM tool and then run the SFC scan in safe mode.
Nothing happens when running “sfc /scannow”Run the DISM tool first and then run the SFC scan in safe mode.
SFC scan completely stopsDisable Intel Turbo Memory and try rerunning the scan.
SFC scan cannot fix the problemFirst run the DISM tool and then run the SFC scan in safe mode.
Scan requires administrative privilegesRun the scan from an administrator account with an elevated Command Prompt.
Reasons for SFC scan failure

Before we discuss the different methods to run the SFC scan, bypassing any issues, let us look at the log file generated when an SFC scan is executed.

How to Open SFC CBS.Log File

When you perform an SFC scan, the system automatically generates a log file named “CBS.log.” This file contains information on the scan that was executed, which can help you advanced troubleshoot if you encounter an issue with the SFC tool.

The CBS.Log file is saved at the following location:

C:\Windows\Logs\CBS

You can open this log file using a text editor, such as Notepad, Word, Wordpad, etc.

Follow these steps to open the file:

  1. Navigate to the following location using File Explorer:

    C:\Windows\Logs\CBS
  2. Here, right-click the file “CBS” then click Open with from the context menu.

    Select Open With from context menu
    Select Open With from context menu
  3. Now select the program you want to open the text file with from the popup and click Ok.

    Select program to open with
    Select program to open with

The log file will then open in the text editor.

CBS Log file
CBS.Log file

Since the CBS.Log file can be lengthy, you can analyze it using the Find function. You can look for keywords in the entire file using the CTRL + F shortcut keys, and then use the following keywords to look for the details on the file that may have been repaired, not repaired, corrupted, etc. Here is a list of the keywords you can use and the respective features you can find.

KeywordDetails
RepairedView files that were repaired
Cannot repairView files SFC failed to repair – Will need to be replaced manually
CorruptFiles that are or were corrupted – Will need to be replaced manually
Keywords to analyze specific files

By analyzing the CBS.Log file, you can pinpoint the files which SFC could not repair, and then replace those files manually using the guide given down below.

How to Fix SFC /ScanNow Failed

If you are not able to fix your operating system using the basic approach for running the SFC scan, then there is still plenty you can do to mitigate the problem.

Note: The below methods need to be performed using only an administrative account and any commands need to be run using an elevated Command Prompt.

Note: The steps given below need to be performed in a methodical order as given.

  1. Scan Hard Drive

    To begin, you first need to scan your hard drive for errors or bad sectors using the Check Disk (CHKDSK) utility, since those could prevent the SFC scan from performing a successful repair. Here is how to do it:

    1. Open Command Prompt with administrative privileges.

    2. Run the following cmdlet:

      Chkdsk C: /f /r /x
    3. You will be asked to schedule the CHKDSK utility the next time the computer reboots. Enter Y for yes.

      chkdsk
      Run Check Disk utility
    4. Now restart your computer. Once it reboots, the Check Disk utility will run and scan your hard drive. This can take a while, in some cases, hours. Let the scan finish and reboot into Windows.

  2. Enable Built-In Administrator Account

    Now enable the built-in Administrator account, which will be needed by following the steps below. Using this account, you will have elevated privileges required to manipulate protected files.

    There are several ways to enable the built-in Administrator account on a Windows computer. Click here to learn more about them.

  3. Reboot in Safe Mode

    Safe Mode is a diagnostic mode that starts Windows in a basic state, loading a limited set of files and drivers. This is intended for troubleshooting Windows problems.

    Perform these steps to boot into Safe Mode with Networking – which means you will have access to the internet which is then later required to run the DISM utility.

    1. Open the System Configuration applet by typing in msconfig in the Run Command box.

      msconfig
      Open System Configuration applet
    2. Switch to the Boot tab. Here, in the Boot options section, check the box next to “Safe Boot,” and then select the Network radio button under it. Once done, click Apply and Ok.

      boot into safe
      Boot into safe mode with networking
    3. In the confirmation dialog box, click Restart.

      restart 3
      Confirm rebooting

    Your computer will now reboot into Safe Mode.

    Learn other methods to boot into Safe Mode.

  4. Log In From Built-In Administrator Account

    Now you must log in to the Administrator account that you enabled earlier. This will allow you to have the privileges to repair missing or corrupted system files.

  5. Run DISM Utility

    Once you are logged in, you must first run the DISM utility to fix the system image. Fixing the system image will then allow the SFC scan to perform its task without any hindrance.

    The DISM tool can be used to prepare, modify, and repair system images. However, you need an active internet connection to download and replace corrupted content from Windows Update, which is why we opted to boot into Safe Mode with internet connectivity.

    Follow these steps to run the DISM utility:

    1. Launch the Command Prompt with administrative privileges.

    2. Now execute the following cmdlets one after the other, allowing each cmdlet sufficient time to complete.

      DISM.exe /Online /Cleanup-image /Checkhealth
      DISM.exe /Online /Cleanup-image /Scanhealth
      DISM.exe /Online /Cleanup-image /Restorehealth
      dism cmd
      Run DISM utility

    Once this is done successfully, do not close the Command Prompt.

  6. Run SFC ScanNow

    Now all you need to do is run the basic SFC scan in an attempt to repair the operating system and the corrupted files within. Run the following cmdlet in an elevated Command Prompt:

    sfc /scannow
    SF scan in Safe Mode
    SFC scan in Safe Mode

That is it! This method should eliminate any issues you experience while performing the SFC scan in basic mode. Restart the computer once the scan is complete.

However, if you find the SFC utility is still unable to fix missing or corrupted files, there are still several things you can do. To begin, we suggest you analyze the CBS.Log file, as we discussed earlier in this post.

Run Offline SFC ScanNow from WinPE

The offline version of the SFC scan means that you run the scan from the Windows Preinstallation Environment (WinPE). This method can be especially useful if you are unable to boot into Windows.

This process requires a Windows installation device (DVD, bootable USB) that has the same OS version as installed.

Perform the following steps to attempt and repair any missing or corrupted system files using the SFC scan with WinPE.

  1. Plugin the bootable device and boot from it.

  2. On the first screen, click Next.

    Proceed to next
    Proceed to next
  3. Now click Repair your computer.

    Attempt to repair
    Attempt to repair
  4. Now select Troubleshoot.

    Select Troubleshoot
    Select Troubleshoot
  5. Now select Command Prompt.

    Open Command Prompt in WinPE
    Open Command Prompt in WinPE
  6. The Command Prompt will now open in front of you. Paste the following cmdlet to verify the drive letter assigned to the volume where Windows is installed.

    bcdedit

    Note down the drive letter beneath “Windows Boot Loader” in front of device.

    Note down drive letter
    Note down drive letter

    Note: Since the drive letters assigned in WinPE are not the same as the default drive letters you see when Windows is booted, these can be different for everyone. Therefore, it is important to determine which drive letter is currently assigned to the boot volume.

  7. Now use the following cmdlet to run the SFC scan here, while replacing DriveLetter (in 2 places) with the letter of the drive where Windows is installed as noted in the last step:

    sfc /scannow /offbootdir=DriveLetter: /offwindir=DriveLetter:\Windows
  8. Once the scan is complete, restart your computer and boot normally into Windows.

If this does not work for you either, you can manually replace the corrupted files yourself.

Manually Replace Corrupted Files

At this point, you must have already analyzed the VBS.Log file we had discussed earlier. Using the file names determined from there, you can manually replace them with healthy files obtained from another computer. Here is how to do it:

  1. Start by taking ownership of the corrupted system file. To do so, run the following cmdlet in an elevated Command Prompt while replacing Path&FileName with the complete path and file name of the corrupted file:

    takeown /f Path&FileName
    Take ownsership of file
    Take ownership of file
  2. Next, grant the Administrators group full access to the file using the following cmdlet while replacing Path&FileName as earlier:

    icacls Path&FileName /GRANT ADMINISTRATORS:F
    Grant Administrators full rights to file
    Grant Administrators full rights to file
  3. Now you should be able to easily replace the file with another copy. At this point, copy the same file from a healthy computer having the same Windows version and paste it here, replacing the current one.

That is it! You can now repeat the same process to manually replace any corrupted files.

Scan Other Non-OS Volumes using SFC

It may be possible that you are running more than one operating system on your PC, and not all of them can be in the same drive (usually the C drive). In that case, you must direct the SFC scan to attempt and repair another drive.

Furthermore, you can also direct it to scan external drives, such as USB flash drives, SD cards, etc.

Here is how to do so:

Note: Since SFC can only fix missing and corrupted files, it can only attempt to repair drives with a Windows operating system in it.

  1. Open Command Prompt with elevated privileges.

  2. Now use the following cmdlet to scan another drive while replacing DriveLetter with the drive letter for the volume you want to scan:

    sfc/scannow/offbootdir=DriveLetter: /offwindir=DriveLetter:\Windows

The scan will now attempt to repair any corrupted or missing files that you selected other than the C drive.

How to Fix “Windows Resource Protection Could Not Start The Repair Service”

It may be possible that you encounter the following error while trying to run an SFC scan on your computer:

Windows Resource Protection could not start the repair service

If so, here are a few things you can do to mitigate this issue:

Start Dependency Service

It may be possible that a dependency service named “Windows Modules Installer (Trusted Installer)” isn’t running on your computer, preventing the scan from happening. In that case, the service needs to be enabled.

  1. Open the Services console by typing in services.msc in the Run Command box.

    services
    Open Services console
  2. Here, scroll down and right-click on the service “Windows Modules Installer” and then click Properties from the context menu.

    Open service properties 1
    Open service properties
  3. From the popup, select “Startup Type” as Automatic, then click Start. When the service starts, click Apply and Ok to save the changes.

    Enable and start service 1
    Enable and start service
  4. Try rerunning the SFC scan.

Learn other methods to enable and disable Windows services.

Disable Turbo Memory

Intel Turbo Memory is a feature that allows NAND memory modules to power up, access programs, and write data on the hard drive much quicker than usual. This feature can be controlled through the system BIOS.

If you experience an SFC scan suddenly stops or cannot complete its job, then you must disable Turbo Memory from the BIOS settings.

Learn how to access BIOS.

Modify Security Descriptors

A Security Descriptor contains security information that may be associated with a securable object. It may be possible that critical Security Descriptors may have corrupted in the WinSXS folder where critical files are stored.

To mitigate this issue, perform the following task:

  1. Launch the Command Prompt with administrative rights.

  2. Now run the following cmdlet:

    ICACLS C:\Windows\winsxs
    Modify Security Descriptor
    Modify Security Descriptors
  3. Now restart your computer and try rerunning the SFC scan.

Other Mitigation Methods

If you encounter the said error, there are other things you can also perform which we have already discussed above in this post. Here is a list of additional steps you can take:

  • Run Check Disk Utility.
  • Run DISM utility.
  • Run SFC scan in Safe Mode.
  • Replace corrupted files manually.

Frequently Asked Questions

Does SFC ScanNow fix anything?

Short answer: Yes, it does. However, the SFC tool itself can occasionally encounter errors, which are also fixable.

How to run SFC scan?

Run the following cmdlet in the Command Prompt:
sfc /scannow

Is the SFC scan safe?

Yes, the SFC scan is completely safe. In fact, you can even run it if nothing is wrong with your computer, just to ensure your device’s integrity.

What does SFC ScanNow actually do?

The SFC ScanNow cmdlet scans all protected files and replaces corrupted files with a cached copy that has been kept in its original shape.

Can you exit SFC scannow?

Yes, it is safe to cancel the scan. However, we do suggest that you allow it to be completed as it causes no harm. If you find that it is stuck you can cancel it using the CTRL + C keys simultaneously.

Does SFC ScanNow improve performance?

If the scan is able to fix critical files, it can sometimes improve the system’s overall performance and speed since the protected files are now as they should be.

Can SFC ScanNowfix BSoDs?

Potentially, yes. BSoDs are often caused by corrupted or missing files, and this is the one thing SFC is good at.

If you liked this post, Share it on:
Subhan Zafar is an established IT professional with interests in Windows and Server infrastructure testing and research, and is currently working with Itechtics as a research consultant. He has studied Electrical Engineering and is also certified by Huawei (HCNA & HCNP Routing and Switching).

Get Updates in Your Inbox

Sign up for the regular updates and be the first to know about the latest tech information

Talk to us now

Talk to us straight and get your questions answered right away

Tell Us About Your Project