To run an SFC scan in Windows 11, open Terminal (Admin) and type sfc /scannow. If SFC reports files it cannot fix, run DISM /Online /Cleanup-Image /RestoreHealth to repair the component store it copies from, restart, then run SFC again. Together the two tools fix most corrupted system files without reinstalling Windows.
| Tool | Command | What it repairs | Typical time |
|---|---|---|---|
| SFC | sfc /scannow |
Protected Windows system files | 5–20 minutes |
| DISM CheckHealth | DISM /Online /Cleanup-Image /CheckHealth |
Nothing; reads the existing corruption flag | Seconds |
| DISM ScanHealth | DISM /Online /Cleanup-Image /ScanHealth |
Nothing; deep scan of the component store | Several minutes |
| DISM RestoreHealth | DISM /Online /Cleanup-Image /RestoreHealth |
The component store (WinSxS) SFC relies on | 10–30 minutes |
| CHKDSK | chkdsk C: /scan |
File system errors on the drive, not Windows files | Varies with drive size |
What do SFC and DISM actually do?
System File Checker (SFC) compares protected Windows files against known-good copies and replaces any that are damaged or missing. DISM (Deployment Image Servicing and Management) repairs the Windows component store, the WinSxS folder that SFC uses as its source. If that store is damaged, SFC has nothing clean to copy from.
That relationship is the key to using them well. SFC fixes the files Windows runs from; DISM fixes the warehouse those replacement files come from.
Both tools are built into every edition of Windows 11 and need an administrator account. Neither touches your documents, photos or installed apps.
When should you run an SFC scan in Windows 11?
Run an SFC scan when Windows itself misbehaves rather than a single app: Settings or the Start menu will not open, built-in tools crash, updates fail repeatedly, or you see errors about missing DLL files. It is also a sensible check after an unexpected power cut or a forced shutdown during an update.
If problems began straight after installing new software, a clean boot is usually the quicker test. If a specific error code keeps appearing, Event Viewer can tell you which component is failing before you start repairing.
What we commonly see: SFC fixes a surprising number of "Settings won't open" and "Start menu is frozen" reports on its own, particularly on PCs that were switched off mid-update.
How do you run sfc /scannow in Windows 11?
Right-click the Start button, choose Terminal (Admin), approve the User Account Control prompt, then type sfc /scannow and press Enter. The scan shows a percentage and usually takes between five and twenty minutes. Leave the window open until it reaches 100% and prints a result.
- Right-click Start and select Terminal (Admin). Command Prompt run as administrator works equally well.
- Select Yes on the User Account Control prompt.
- Type
sfc /scannowand press Enter. - Wait for verification to reach 100%. Do not close the window or restart during the scan.
- Read the result message, then restart if any files were repaired.
If you see "You must be an administrator running a console session", the window was not opened with admin rights. Close it and start again from step 1.
What do the SFC result messages mean?
SFC finishes with one of four messages. "Did not find any integrity violations" means your system files are fine. "Found corrupt files and successfully repaired them" means the fix worked. "Found corrupt files but was unable to fix some of them" or "could not perform the requested operation" means you should run DISM next.
- Windows Resource Protection did not find any integrity violations. System files are healthy; look elsewhere for the cause.
- Windows Resource Protection found corrupt files and successfully repaired them. Restart and check whether the problem has gone.
- Windows Resource Protection found corrupt files but was unable to fix some of them. The component store is likely damaged. Run DISM RestoreHealth, then SFC again.
- Windows Resource Protection could not perform the requested operation. Often caused by pending repairs or a locked file. Restart and try again, or run SFC from Safe Mode.
How do you read the CBS.log file after SFC?
SFC writes every action to C:\Windows\Logs\CBS\CBS.log. That file is large and mixed with other servicing entries, so filter it to SFC lines only. Microsoft's documented command copies just the SFC entries into a text file on your desktop that you can open in Notepad.
- Open Terminal (Admin) and switch to a Command Prompt tab, or open Command Prompt as administrator.
- Run:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" - Open sfcdetails.txt from your desktop.
- Scroll to the most recent date and time. Look for lines containing Cannot repair member file to see which files SFC could not fix.
Advanced nuance: the filtered file includes entries from every SFC run, not just the latest one. Match the timestamps to your scan before drawing conclusions, otherwise you may chase a file that was repaired weeks ago.
DISM keeps its own log at C:\Windows\Logs\DISM\dism.log, which is the place to look if RestoreHealth fails.
How do you use DISM CheckHealth, ScanHealth and RestoreHealth?
Run the three DISM switches in order of depth. CheckHealth reads an existing corruption flag in seconds, ScanHealth performs a full scan of the component store, and RestoreHealth scans and repairs it, downloading clean files from Windows Update by default. All three use the /Online switch to work on the running copy of Windows.
- Open Terminal (Admin).
- Run
DISM /Online /Cleanup-Image /CheckHealth. It reports whether the image is healthy, repairable or non-repairable. - Run
DISM /Online /Cleanup-Image /ScanHealthfor a thorough check. This takes several minutes. - If either reports corruption, run
DISM /Online /Cleanup-Image /RestoreHealth. - Keep the PC connected to the internet. Progress can sit on the same percentage for several minutes; that is normal behaviour, so leave it running.
- When DISM reports "The restore operation completed successfully", restart and run
sfc /scannowagain.
Many technicians skip straight to RestoreHealth because it includes a scan. That is fine; as Microsoft's Repair a Windows image reference explains, CheckHealth and ScanHealth are useful mainly when you want to confirm corruption before changing anything.
Should you run DISM or SFC first?
Run DISM RestoreHealth first when you already suspect deeper damage, then SFC. DISM repairs the component store, and SFC then uses that repaired store to fix live system files. If you run SFC first on a damaged store, it may report files it cannot repair, which simply sends you back to DISM anyway.
Cause and effect: SFC is only as good as its source. A corrupted WinSxS store produces repeated "unable to fix" results however many times you run SFC, while a single successful DISM pass usually lets the next SFC scan finish cleanly.
A practical sequence that covers most cases:
DISM /Online /Cleanup-Image /RestoreHealth- Restart the PC.
sfc /scannow- If SFC repaired files, restart and run it once more to confirm a clean result.
How do you run DISM with an offline source (install.wim)?
If DISM fails with error 0x800f081f ("The source files could not be found"), or the PC has no working internet connection, point DISM at a Windows 11 ISO instead of Windows Update. Mount the ISO, find the index of your edition inside install.wim, and add /Source and /LimitAccess to the RestoreHealth command.
- Download a Windows 11 ISO that matches your installed version and language. Our bootable USB guide covers where to get official media.
- Right-click the ISO and select Mount. Note the drive letter, for example D:.
- List the editions:
DISM /Get-WimInfo /WimFile:D:\sources\install.wim. Note the index number for your edition (Home, Pro and so on). - Run the repair, replacing the index:
DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:6 /LimitAccess
/LimitAccess stops DISM contacting Windows Update, so it relies on your ISO alone. Microsoft's guide to configuring a Windows repair source explains the Wim: path format and index requirement.
What we commonly see: offline repairs fail most often because the ISO is a different version from the installed system, for example a 24H2 ISO on a 25H2 PC. Check your Windows 11 version first and download matching media.
What is the difference between SFC, DISM and CHKDSK?
SFC repairs Windows system files, DISM repairs the component store those files come from, and CHKDSK checks the drive's file system and, with the right switch, scans for bad sectors. CHKDSK does not know what a Windows file should contain; it only checks that the disk structure holding files is consistent.
-
chkdsk C: /scanruns an online scan without restarting. -
chkdsk C: /ffixes file system errors and schedules itself for the next restart on the system drive. -
chkdsk C: /ralso locates bad sectors and recovers readable data, which can take hours on large hard drives.
Run CHKDSK first if you see disk errors, files that vanish, or a drive that clicks or slows dramatically. Corrupted system files on a failing drive will come back however often SFC repairs them.
What if SFC and DISM cannot fix Windows 11?
If repeated DISM and SFC passes still fail, try SFC offline from the Windows Recovery Environment, then consider an in-place repair install. A repair install reinstalls Windows 11 over itself from a matching ISO, keeping your files and apps, and replaces every system file in one pass.
-
Offline SFC: from WinRE, open Command Prompt and run
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows. Drive letters can differ in WinRE, so check withdirfirst. If WinRE itself is missing, see our fix for "Could not find the recovery environment". - In-place repair: mount a matching ISO, run setup.exe and choose to keep personal files and apps.
- Reset this PC: the last step before a clean install, available under Settings > System > Recovery.
A repair install keeps your existing activation, provided Windows was activated with a genuine licence beforehand. If you are rebuilding a PC that never had a valid licence, a genuine Windows 11 Pro key lets you activate cleanly once the system is healthy.
Frequently asked questions
Is it safe to run sfc /scannow?
Yes. SFC only replaces protected Windows system files with known-good copies from the component store, and it does not delete or modify personal files, documents or installed programs. The main precaution is to let the scan finish without restarting, and to save any open work first in case a restart is needed afterwards.
How long does DISM RestoreHealth take?
On most modern PCs with an SSD and a decent internet connection, RestoreHealth takes roughly 10 to 30 minutes. It can take longer on hard drives or slow connections. Progress often pauses on one percentage for several minutes; this is normal behaviour, so leave it running rather than closing the window.
Does SFC fix activation problems?
Not usually. SFC repairs damaged system files, but activation depends on a valid product key or digital licence tied to your hardware. If Windows shows activation errors after a repair, check Settings > System > Activation and run the Activation troubleshooter, which handles licence issues that SFC and DISM cannot.
Can I run SFC on Windows 11 Home?
Yes. SFC, DISM and CHKDSK are included in every edition of Windows 11, including Home, Pro, Education and Enterprise. You only need an account with administrator rights to open an elevated terminal. The commands and results are identical across editions, so this guide applies to every Windows 11 PC.
Why does SFC keep finding corrupt files every time?
Repeated findings usually mean the component store is damaged, so run DISM RestoreHealth before SFC. If corruption keeps returning after successful repairs, suspect the drive or memory: run chkdsk C: /scan and Windows Memory Diagnostic, because failing hardware can corrupt freshly repaired files.
Related guides
- Windows 11 update stuck or failed? How to fix it
- How to perform a clean boot in Windows 11
- Fix "Could not find the recovery environment" in Windows 11
- How to use Event Viewer in Windows 11
- 15 common Windows 11 problems and how to fix them
Links in this guide
| Link | Type | Why it helps |
|---|---|---|
| Clean boot in Windows 11 | Internal | Rules out third-party software before repairing system files |
| Event Viewer guide | Internal | Identifies the failing component behind recurring errors |
| Create a Windows 11 bootable USB | Internal | Where to get official media for offline DISM repairs |
| Check your Windows 11 version | Internal | Ensures your ISO matches the installed version |
| Windows 11 Pro key | Internal | Genuine licence for activating a rebuilt PC |
| Microsoft Support: System File Checker | External | Official CBS.log filtering command and manual file replacement |
| Microsoft Learn: Repair a Windows image | External | Reference for CheckHealth, ScanHealth and RestoreHealth |
| Microsoft Learn: Configure a Windows repair source | External | Explains WIM source paths and index numbers |