How To Run SFC /SCANNOW To Repair Windows System Files

The system file checker tool is a useful command used to scan and repair corrupt or damaged system files. This command is usually used when users encounter problems with the system files of Windows OS.

sfc /scannow is the most popular command to scan for corrupt system files immediately. It will not only scan, but also try to repair or replace corrupt system files with healthy ones. It requires a Windows installation source to copy files from.

The system file checker is a universal command and can be used in all Windows operating systems, including Windows 11, Windows 10, Windows 8, Windows 7 and Windows Vista.

This command line can perform several functions. We will discuss these in this article.

SFC Switches

The table below lists all the switches which can be used with the SFC command-line tool, and their functions:

Commands	Function
sfc /scannow	Scan for issues. If found, replace the file from the DLL cache.
sfc /scanonce	Will scan only once.
sfc /scanboot	Will scan the computer at every boot.
sfc /revert	Revert the scanning functionality to its original (default) state.
sfc /purgecache	Will remove the Windows File Protection cache and begin a scan over the system files.
sfc /cachesize=X	Set the cache size of the Windows File Protection to X MBs.
sfc /?	Display help regarding switches.

Today, we are only going to be focusing on the “sfc /scannow” cmdlet as it is the one that quickly and effectively fixes your operating system.

Running Basic SFC Scan

The simplest (and most convenient) method to run the system file checker command is by running the following cmdlet in an elevated Command Prompt window:

sfc /scannow

The cmdlet will then perform its job and attempt to repair any protected files that may have been corrupted. However, that is not always the case, and users may encounter different errors from time to time.

Before we discuss these different errors, let us discuss the various outputs of the basic scan and what each of those means.

Outputs of SFC Scan

As you can observe in the image above, the output of the SFC scan states the following:

Windows Resource Protection found corrupted files and successfully repaired them.

It then also states the location of a CBS.log file which contains the details of the performed scan – we’ll get into that a moment later.

Let us now see all the possible outputs of the SFC scan that different users can encounter and what they mean:

Output Statement	Meaning
Windows Resource Protection did not find any integrity violations.	No missing or corrupted system files were detected, meaning your system’s integrity is intact.
Windows Resource Protection could not perform the requested operation.	An unknown issue occurred and the scan could not be performed. In this case, you must adopt the alternative methods given below in this post.
Windows Resource Protection found corrupt files and successfully repaired them.	Missing or corrupted files were found and have been repaired, restoring your system’s integrity.
Windows Resource Protection found corrupt files but was unable to fix some of them.	Your system’s integrity was compromised, but SFC did not work. In this case, you must adopt alternative methods to fix the issue or replace the files manually using the given guide further down this post.

Apart from this, there are other possible issues that you may encounter while performing the scan.

Why SFC Scan Failed

You may encounter any one of the following scenarios while performing an SFC scan. The table below lists those scenarios along with their possible solutions.

Note: The methods to perform these solutions are discussed below.

Symptom of Failure	Possible Solution
Scan stuck at verification	Run the scan in safe mode or replace files manually
Scan gets frozen at a certain percentage	First run the DISM tool and then run the SFC scan in safe mode.
Nothing happens when running “sfc /scannow”	Run the DISM tool first and then run the SFC scan in safe mode.
SFC scan completely stops	Disable Intel Turbo Memory and try rerunning the scan.
SFC scan cannot fix the problem	First run the DISM tool and then run the SFC scan in safe mode.
Scan requires administrative privileges	Run the scan from an administrator account with an elevated Command Prompt.

Before we discuss the different methods to run the SFC scan, bypassing any issues, let us look at the log file generated when an SFC scan is executed.

How to Open SFC CBS.Log File

When you perform an SFC scan, the system automatically generates a log file named “CBS.log.” This file contains information on the scan that was executed, which can help you advanced troubleshoot if you encounter an issue with the SFC tool.

The CBS.Log file is saved at the following location:

C:\Windows\Logs\CBS

You can open this log file using a text editor, such as Notepad, Word, Wordpad, etc.

Follow these steps to open the file:

1. Navigate to the following location using File Explorer:

   C:\Windows\Logs\CBS

2. Here, right-click the file “CBS” then click Open with from the context menu.

   

3. Now select the program you want to open the text file with from the popup and click Ok.

   

The log file will then open in the text editor.

Since the CBS.Log file can be lengthy, you can analyze it using the Find function. You can look for keywords in the entire file using the CTRL + F shortcut keys, and then use the following keywords to look for the details on the file that may have been repaired, not repaired, corrupted, etc. Here is a list of the keywords you can use and the respective features you can find.

Keyword	Details
Repaired	View files that were repaired
Cannot repair	View files SFC failed to repair – Will need to be replaced manually
Corrupt	Files that are or were corrupted – Will need to be replaced manually

By analyzing the CBS.Log file, you can pinpoint the files which SFC could not repair, and then replace those files manually using the guide given down below.

How to Fix SFC /ScanNow Failed

If you are not able to fix your operating system using the basic approach for running the SFC scan, then there is still plenty you can do to mitigate the problem.

Note: The below methods need to be performed using only an administrative account and any commands need to be run using an elevated Command Prompt.

Note: The steps given below need to be performed in a methodical order as given.

1. Scan Hard Drive

   To begin, you first need to scan your hard drive for errors or bad sectors using the Check Disk (CHKDSK) utility, since those could prevent the SFC scan from performing a successful repair. Here is how to do it:

   1. Open Command Prompt with administrative privileges.

   2. Run the following cmdlet:

      Chkdsk C: /f /r /x

   3. You will be asked to schedule the CHKDSK utility the next time the computer reboots. Enter Y for yes.

      

   4. Now restart your computer. Once it reboots, the Check Disk utility will run and scan your hard drive. This can take a while, in some cases, hours. Let the scan finish and reboot into Windows.

2. Enable Built-In Administrator Account

   Now enable the built-in Administrator account, which will be needed by following the steps below. Using this account, you will have elevated privileges required to manipulate protected files.

   There are several ways to enable the built-in Administrator account on a Windows computer. Click here to learn more about them.

3. Reboot in Safe Mode

   Safe Mode is a diagnostic mode that starts Windows in a basic state, loading a limited set of files and drivers. This is intended for troubleshooting Windows problems.

   Perform these steps to boot into Safe Mode with Networking – which means you will have access to the internet which is then later required to run the DISM utility.

   1. Open the System Configuration applet by typing in msconfig in the Run Command box.

      

   2. Switch to the Boot tab. Here, in the Boot options section, check the box next to “Safe Boot,” and then select the Network radio button under it. Once done, click Apply and Ok.

      

   3. In the confirmation dialog box, click Restart.

      

   Your computer will now reboot into Safe Mode.

   Learn other methods to boot into Safe Mode.

4. Log In From Built-In Administrator Account

   Now you must log in to the Administrator account that you enabled earlier. This will allow you to have the privileges to repair missing or corrupted system files.

5. Run DISM Utility

   Once you are logged in, you must first run the DISM utility to fix the system image. Fixing the system image will then allow the SFC scan to perform its task without any hindrance.

   The DISM tool can be used to prepare, modify, and repair system images. However, you need an active internet connection to download and replace corrupted content from Windows Update, which is why we opted to boot into Safe Mode with internet connectivity.

   Follow these steps to run the DISM utility:

   1. Launch the Command Prompt with administrative privileges.

   2. Now execute the following cmdlets one after the other, allowing each cmdlet sufficient time to complete.

      DISM.exe /Online /Cleanup-image /Checkhealth
      DISM.exe /Online /Cleanup-image /Scanhealth
      DISM.exe /Online /Cleanup-image /Restorehealth

      

   Once this is done successfully, do not close the Command Prompt.

6. Run SFC ScanNow

   Now all you need to do is run the basic SFC scan in an attempt to repair the operating system and the corrupted files within. Run the following cmdlet in an elevated Command Prompt:

   sfc /scannow

   

That is it! This method should eliminate any issues you experience while performing the SFC scan in basic mode. Restart the computer once the scan is complete.

However, if you find the SFC utility is still unable to fix missing or corrupted files, there are still several things you can do. To begin, we suggest you analyze the CBS.Log file, as we discussed earlier in this post.

Run Offline SFC ScanNow from WinPE

The offline version of the SFC scan means that you run the scan from the Windows Preinstallation Environment (WinPE). This method can be especially useful if you are unable to boot into Windows.

This process requires a Windows installation device (DVD, bootable USB) that has the same OS version as installed.

Perform the following steps to attempt and repair any missing or corrupted system files using the SFC scan with WinPE.

1. Plugin the bootable device and boot from it.

2. On the first screen, click Next.

   

3. Now click Repair your computer.

   

4. Now select Troubleshoot.

   

5. Now select Command Prompt.

   

6. The Command Prompt will now open in front of you. Paste the following cmdlet to verify the drive letter assigned to the volume where Windows is installed.

   bcdedit

   Note down the drive letter beneath “Windows Boot Loader” in front of device.

   

   Note: Since the drive letters assigned in WinPE are not the same as the default drive letters you see when Windows is booted, these can be different for everyone. Therefore, it is important to determine which drive letter is currently assigned to the boot volume.

7. Now use the following cmdlet to run the SFC scan here, while replacing DriveLetter (in 2 places) with the letter of the drive where Windows is installed as noted in the last step:

   sfc /scannow /offbootdir=DriveLetter: /offwindir=DriveLetter:\Windows

8. Once the scan is complete, restart your computer and boot normally into Windows.

If this does not work for you either, you can manually replace the corrupted files yourself.

Manually Replace Corrupted Files

At this point, you must have already analyzed the VBS.Log file we had discussed earlier. Using the file names determined from there, you can manually replace them with healthy files obtained from another computer. Here is how to do it:

1. Start by taking ownership of the corrupted system file. To do so, run the following cmdlet in an elevated Command Prompt while replacing Path&FileName with the complete path and file name of the corrupted file:

   takeown /f Path&FileName

   

2. Next, grant the Administrators group full access to the file using the following cmdlet while replacing Path&FileName as earlier:

   icacls Path&FileName /GRANT ADMINISTRATORS:F

   

3. Now you should be able to easily replace the file with another copy. At this point, copy the same file from a healthy computer having the same Windows version and paste it here, replacing the current one.

That is it! You can now repeat the same process to manually replace any corrupted files.

Scan Other Non-OS Volumes using SFC

It may be possible that you are running more than one operating system on your PC, and not all of them can be in the same drive (usually the C drive). In that case, you must direct the SFC scan to attempt and repair another drive.

Furthermore, you can also direct it to scan external drives, such as USB flash drives, SD cards, etc.

Here is how to do so:

Note: Since SFC can only fix missing and corrupted files, it can only attempt to repair drives with a Windows operating system in it.

1. Open Command Prompt with elevated privileges.

2. Now use the following cmdlet to scan another drive while replacing DriveLetter with the drive letter for the volume you want to scan:

   sfc/scannow/offbootdir=DriveLetter: /offwindir=DriveLetter:\Windows

The scan will now attempt to repair any corrupted or missing files that you selected other than the C drive.

How to Fix “Windows Resource Protection Could Not Start The Repair Service”

It may be possible that you encounter the following error while trying to run an SFC scan on your computer:

Windows Resource Protection could not start the repair service

If so, here are a few things you can do to mitigate this issue:

Start Dependency Service

It may be possible that a dependency service named “Windows Modules Installer (Trusted Installer)” isn’t running on your computer, preventing the scan from happening. In that case, the service needs to be enabled.

1. Open the Services console by typing in services.msc in the Run Command box.

   

2. Here, scroll down and right-click on the service “Windows Modules Installer” and then click Properties from the context menu.

   

3. From the popup, select “Startup Type” as Automatic, then click Start. When the service starts, click Apply and Ok to save the changes.

   

4. Try rerunning the SFC scan.

Learn other methods to enable and disable Windows services.

Disable Turbo Memory

Intel Turbo Memory is a feature that allows NAND memory modules to power up, access programs, and write data on the hard drive much quicker than usual. This feature can be controlled through the system BIOS.

If you experience an SFC scan suddenly stops or cannot complete its job, then you must disable Turbo Memory from the BIOS settings.

Learn how to access BIOS.

Modify Security Descriptors

A Security Descriptor contains security information that may be associated with a securable object. It may be possible that critical Security Descriptors may have corrupted in the WinSXS folder where critical files are stored.

To mitigate this issue, perform the following task:

1. Launch the Command Prompt with administrative rights.

2. Now run the following cmdlet:

   ICACLS C:\Windows\winsxs

   

3. Now restart your computer and try rerunning the SFC scan.

Other Mitigation Methods

If you encounter the said error, there are other things you can also perform which we have already discussed above in this post. Here is a list of additional steps you can take:

• Run Check Disk Utility.
• Run DISM utility.
• Run SFC scan in Safe Mode.
• Replace corrupted files manually.

Frequently Asked Questions