How to use SFC /Scannow to Repair Windows System Files

Despite how far Windows has evolved, system file corruption is still something every IT professional encounters—whether you’re managing a single endpoint, a fleet of laptops, or virtual machines in an enterprise environment.

Over the years, I’ve used SFC /Scannow countless times in real-world scenarios:

• Failed Windows updates that refuse to install
• Random BSODs with no clear driver culprit
• Broken Windows features (Search, Start Menu, Settings)
• Servers behaving strangely after patching or abrupt power loss

While newer tools like DISM get a lot of attention, System File Checker (SFC) remains one of the first diagnostic tools I reach for. It’s fast, built-in, and often surprisingly effective—if you understand its limitations and how to use it properly.

This article goes beyond the basic “run the command and hope for the best” approach. Instead, we’ll look at how SFC actually works, when it helps, when it doesn’t, and how to interpret its output like an experienced Windows administrator.

What Is SFC (System File Checker)?

System File Checker is a Windows command-line utility that scans the integrity of protected system files and replaces corrupted or missing versions with known-good copies stored in the Windows Component Store (WinSxS).

Key points IT pros should know:

• SFC does not scan third-party applications
• It only checks protected Windows files
• It relies entirely on the health of the component store
• If the component store is damaged, SFC may fail or partially repair files

This dependency is why SFC and DISM are often used together in modern troubleshooting workflows.

How SFC /Scannow Works Under the Hood

When you run:

sfc /scannow

Windows performs several behind-the-scenes steps:

1. Verifies hashes of protected system files
2. Compares them against known good versions
3. Pulls replacements from WinSxS if corruption is detected
4. Logs results to CBS.log

This process explains why SFC can:

• Fix some issues instantly
• Fail completely on badly corrupted systems
• Report corruption but be unable to repair it

Understanding this behaviour helps set realistic expectations when troubleshooting.

Running a Basic SFC Scan (Correctly)

Step 1: Open an Elevated Command Prompt

You must run SFC with administrative privileges.

• Start Menu → type cmd
• Right-click Command Prompt
• Select Run as administrator

Or, for modern admins:

• Right-click Start → Windows Terminal (Admin)

Step 2: Run the Scan

sfc /scannow

The scan typically takes 5–20 minutes, depending on:

• Disk speed (SSD vs HDD)
• System load
• Overall Windows health

From experience, letting the scan complete uninterrupted reduces false failures—especially on older systems.

Understanding SFC Results (What They Actually Mean)

Once the scan finishes, you’ll see one of four outcomes.

1. “Windows Resource Protection did not find any integrity violations”

This means:

• Core system files are intact
• Your issue likely lies elsewhere (drivers, registry, user profile, hardware)

In practice, this result often pushes me toward:

• DISM
• Event Viewer analysis
• Hardware diagnostics

2. “Windows Resource Protection found corrupt files and successfully repaired them”

Best-case scenario.

At this point:

• Reboot the system
• Re-test the original issue
• Re-run Windows Update if applicable

Pro tip: Always reboot, even if Windows doesn’t explicitly ask you to.

3. “Windows Resource Protection found corrupt files but was unable to fix some of them”

This is where many admins get stuck.

It usually indicates:

• Component store corruption
• File locks preventing repair
• Partial Windows update failures

At this stage, SFC alone is no longer enough—DISM is required (covered later).

4. “Windows Resource Protection could not perform the requested operation”

Common causes include:

• Pending updates
• Disk errors
• File system corruption
• Incomplete servicing operations

Running SFC in Safe Mode or checking the WinSxS Temp directories often resolves this.

Running SFC /Scannow in Safe Mode

Safe Mode strips Windows down to essentials, eliminating interference from:

• Third-party antivirus
• Endpoint protection agents
• Startup services

Steps to Boot into Safe Mode

1. Press Win + R
2. Type: msconfig
3. Go to the Boot tab
4. Check Safe boot → Minimal
5. Click Apply → OK
6. Restart

Once in Safe Mode, run:

sfc /scannow

In my experience, this resolves a surprising number of “SFC stuck” or “operation could not be completed” errors.

Where to Find and Read SFC Logs

SFC writes its findings to:

%WinDir%\Logs\CBS\CBS.log

Filtering Relevant SFC Entries

CBS.log can be huge. To extract only SFC entries:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log > sfcdetails.txt

This filtered log is invaluable when:

• Diagnosing repeated failures
• Escalating issues internally
• Deciding whether a repair install is justified

Common SFC /Scannow Problems (And What Actually Fixes Them)

SFC Stuck at Verification

Usually caused by:

• Disk issues
• File locks
• Pending servicing operations

Fixes that work in practice:

• Reboot and retry
• Run CHKDSK
• Boot into Safe Mode

SFC Freezes or Appears Hung

If CPU and disk activity drop to zero:

• Give it 10–15 minutes
• If still frozen, cancel and reboot
• Run DISM first, then SFC again

“You Must Be an Administrator”

This is almost always user error.

• Ensure Command Prompt or Terminal is elevated
• Group Policy restrictions can also cause this in managed environments

Why DISM Often Comes Before SFC (Modern Best Practice)

In modern Windows versions (10/11 and Server 2016+), I rarely run SFC before DISM.

Preferred workflow:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM repairs the component store, which SFC depends on. Without a healthy store, SFC is working blind.

This approach has saved me countless hours on:

• Broken Windows Update stacks
• Corrupted server images
• Persistent system file errors

When SFC Is Not Enough

There are times when SFC simply can’t help:

• Deep registry corruption
• Failed feature upgrades
• Hardware-level disk errors

At that point, your options are:

• In-place repair install
• Restore from backup
• Full OS rebuild (last resort)

Recognising when to stop troubleshooting is part of professional IT judgment.

Final Thoughts from the Field

SFC /Scannow isn’t flashy, but it’s one of those tools every Windows admin should understand deeply. Used correctly—and paired with DISM—it can:

• Save rebuild time
• Reduce downtime
• Restore system stability quickly

The key is knowing what it can fix, what it can’t, and how to read the results properly.

If you’re serious about Windows troubleshooting, SFC shouldn’t just be a command you run—it should be part of a repeatable diagnostic process.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.