System File Checker (SFC): Complete Guide & Tutorial

What is System File Checker (SFC)?

System File Checker (sfc.exe) is a Windows command-line utility that verifies the integrity of all protected operating system files. It's part of Windows Resource Protection (WRP), which prevents unauthorized or accidental modification of critical system files.

Key capabilities:

• Comprehensive scanning: Checks hundreds of thousands of system files
• Automatic repair: Replaces corrupted files from cached copies in the component store
• Version verification: Ensures files match the correct version for your Windows installation
• Detailed logging: Records all actions in CBS.log for review
• Safe operation: Only modifies files that are verifiably corrupted

Files protected by SFC/WRP include:

• Windows system DLL files (kernel32.dll, ntdll.dll, etc.)
• System executables (.exe files in Windows and System32 folders)
• Device driver files (.sys)
• Windows fonts and resources
• System registry hives
• Windows Update components
• Windows Explorer and shell components

When Should You Run SFC?

SFC is appropriate for diagnosing and fixing these common Windows issues:

Critical Situations (Run Immediately):

• Blue Screen of Death (BSOD) errors - Especially those referencing system files
• Windows won't boot normally - Boot to Safe Mode or Recovery Environment first
• Windows Update failures - Particularly error codes like 0x80070643, 0x800f0805, 0x80073712
• System restore failures - When restore points cannot apply
• DLL errors on startup - Messages about missing or corrupted .dll files

Common Issues (Recommended):

• Applications crashing frequently - Especially built-in Windows apps
• Windows features not working - Start Menu, Taskbar, Search, Settings app
• Slow system performance - Without obvious cause
• File Explorer freezing or crashing
• Windows Defender or Security Center errors
• Printer or device driver issues
• After malware removal - To repair damage malware may have caused

Preventive Maintenance:

• Run quarterly as part of regular system maintenance
• Before major Windows feature updates
• After installing or uninstalling system-level software
• Following power outages or improper shutdowns

How to Run SFC: Basic Scan (Most Common Method)

The standard SFC scan checks all protected system files and repairs issues automatically. This is what 95% of users need.

1. Press Windows + X to open the Quick Link menu
2. Select Terminal (Admin) or Command Prompt (Admin)
3. If you see User Account Control, click Yes
4. In the command window, type: sfc /scannow
5. Press Enter
6. You'll see: "Beginning system scan. This process will take some time."
7. A progress percentage will appear and slowly increase
8. Do not close this window or restart your computer until it reaches 100%
9. The scan typically takes 15-45 minutes depending on:
   • System speed (SSD vs. HDD)
   • Number of system files
   • Extent of corruption
10. After completion, you'll see one of several possible messages (explained below)
11. Restart your computer to apply repairs
12. Check if your original issue is resolved

Important notes:

• You can continue using your computer during the scan, but avoid intensive operations
• If the scan appears stuck at a certain percentage (e.g., 27%, 48%, 73%), be patient—these are known checkpoints where verification is thorough
• Don't force-close the Command Prompt window; let the scan complete naturally

Understanding SFC Results: What Each Message Means

After the scan completes, SFC displays one of four primary messages. Here's what each means and what to do next:

Result 1: "Windows Resource Protection did not find any integrity violations"

Meaning: All system files are intact and uncorrupted. No repairs were needed.

What to do: Your system files are healthy. If you're still experiencing issues, the problem lies elsewhere—check drivers, run malware scans, check disk health with CHKDSK, or investigate application-specific problems.

Result 2: "Windows Resource Protection found corrupt files and successfully repaired them"

Meaning: SFC found corrupted files and fixed them automatically using cached copies from the component store.

What to do:

• Restart your computer to ensure repairs take effect
• Test your system for the original issue
• Check the CBS.log file to see which files were repaired (instructions below)
• Consider running the scan again to verify all issues are resolved

Result 3: "Windows Resource Protection found corrupt files but was unable to fix some of them"

Meaning: SFC detected corruption but couldn't repair certain files. This usually means:

• The component store itself is corrupted (run DISM first, then SFC again)
• Files are in use and locked (run SFC in Safe Mode or Recovery Environment)
• Severe system damage requiring advanced repairs

What to do: See "Troubleshooting SFC Failures" section below.

Result 4: "Windows Resource Protection could not perform the requested operation"

Meaning: SFC couldn't run properly. Common causes:

• Windows Update or Windows Module Installer service not running
• Insufficient permissions (not running as administrator)
• CBS or WinSxS folder permissions issues

What to do: See "SFC Won't Run" troubleshooting section below.

Running SFC in Safe Mode (For Locked Files)

If standard SFC fails because files are in use, Safe Mode loads Windows with minimal drivers and services, allowing SFC to repair locked files.

Boot to Safe Mode:

1. Press Windows + I to open Settings
2. Go to System → Recovery (Windows 11) or Update & Security → Recovery (Windows 10)
3. Under "Advanced startup", click Restart now
4. Your PC will restart to a blue screen with options
5. Click Troubleshoot → Advanced options → Startup Settings → Restart
6. After restart, press 4 or F4 to select Enable Safe Mode
7. Or press 5 or F5 for Safe Mode with Networking (needed if SFC requires Windows Update access)
8. Windows will boot into Safe Mode
9. Open Command Prompt as Administrator
10. Run: sfc /scannow
11. Wait for completion
12. Restart normally

Alternative: Safe Mode via msconfig

1. Press Windows + R, type msconfig, press Enter
2. Go to the Boot tab
3. Check Safe boot and select Minimal
4. Click OK and restart
5. Run SFC in Safe Mode
6. Return to msconfig and uncheck Safe boot to return to normal mode

Running SFC from Windows Recovery Environment

If Windows won't boot even to Safe Mode, use the Windows Recovery Environment (WinRE) to run offline SFC scans.

Access WinRE:

1. Method 1: From Windows login screen, hold Shift and click Power → Restart
2. Method 2: If Windows won't load, force shutdown 3 times during boot to trigger automatic repair
3. Method 3: Boot from Windows installation USB/DVD and select "Repair your computer"
4. Choose Troubleshoot → Advanced options → Command Prompt

Run Offline SFC:

1. In the Command Prompt, first identify your Windows drive letter (it may not be C: in WinRE)
2. Type: diskpart
3. Type: list volume
4. Look for the volume with your Windows installation (usually the largest volume, labeled "Windows" or "OS")
5. Note its drive letter (e.g., D:)
6. Type: exit to close diskpart
7. Run offline SFC using this syntax:
8. sfc /scannow /offbootdir=C:\ /offwindir=D:\Windows
9. Replace C:\ with your system partition (usually hidden, small ~500MB partition)
10. Replace D:\Windows with the actual Windows folder location you identified
11. Press Enter and wait for completion
12. Close Command Prompt and restart

Finding the correct drives:

• /offbootdir = System partition (contains boot files, often hidden)
• /offwindir = Windows installation folder (contains \Windows directory)
• If unsure, try: sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows first

Viewing Detailed SFC Results: Reading CBS.log

SFC records all scan details in the Component-Based Servicing log. This shows exactly which files were checked, repaired, or failed.

Extract SFC-Specific Log Entries:

1. Open Command Prompt (Admin)
2. Run this command to create a filtered SFC report on your desktop:
3. findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\sfcdetails.txt"
4. Press Enter
5. Open sfcdetails.txt on your desktop with Notepad
6. The file contains entries like:
   • [SR] Verifying 100 (0x00000064) components - Scan progress
   • [SR] Cannot repair member file... - Files SFC couldn't fix
   • [SR] Successfully repaired file... - Fixed files

Understanding Log Entries:

Example entry:

[SR] Cannot repair member file [l:24{12}]"mshtml.dll" of Microsoft-Windows-IE-HTMLRendering, Version = 11.0.19041.1165, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

What this means:

• File: mshtml.dll (Internet Explorer HTML rendering component)
• Issue: Hash mismatch (file is corrupted or wrong version)
• Status: Cannot repair (component store may need DISM repair)

When SFC Fails: Run DISM First

If SFC reports "found corrupt files but was unable to fix some", the Windows component store (the source SFC uses for repairs) is likely corrupted. DISM repairs the component store so SFC can then work properly.

The Correct Repair Sequence:

1. Step 1: Check component store health
2. Open Command Prompt (Admin)
3. Run: DISM /Online /Cleanup-Image /CheckHealth
4. This quick check (30 seconds) reports if corruption exists
5. Step 2: Scan for corruption
6. Run: DISM /Online /Cleanup-Image /ScanHealth
7. This thorough scan (5-15 minutes) identifies specific issues
8. Step 3: Repair component store
9. Run: DISM /Online /Cleanup-Image /RestoreHealth
10. This downloads repairs from Windows Update (10-30 minutes)
11. Wait for: "The restore operation completed successfully"
12. Step 4: Run SFC again
13. Now run: sfc /scannow
14. SFC should now successfully repair files it previously couldn't
15. Restart your computer

Why this sequence works: DISM repairs the component store (WinSxS folder) that contains the reference files SFC uses for repairs. Once DISM fixes the component store, SFC has access to clean files for comparison and replacement.

Troubleshooting: SFC Won't Run

Error: "Windows Resource Protection could not start the repair service"

Solution: Start Windows Module Installer service

1. Press Windows + R, type services.msc, press Enter
2. Find Windows Modules Installer
3. Right-click it and select Start
4. If it won't start, right-click and select Properties
5. Set Startup type to Manual
6. Click Apply, then try Start again
7. Run SFC again

Error: "Windows Resource Protection could not perform the requested operation"

Solution: Check service dependencies and permissions

1. Ensure these services are running (services.msc):
   • Windows Modules Installer
   • Windows Update
   • Cryptographic Services
2. If still failing, reset Windows Update components (see Method 6 of error 0x80248007 guide)
3. Check system partition has at least 5 GB free space
4. Run SFC from Safe Mode instead

SFC Hangs at Certain Percentages

Common hang points: 4%, 27%, 48%, 73%

These aren't actually hangs—SFC performs extensive verification at these checkpoints. Wait at least 30-60 minutes before concluding it's truly stuck.

If genuinely stuck:

• Don't force-close. Let it run overnight if necessary
• Check Task Manager: if sfc.exe shows CPU/disk activity, it's working
• If no activity for 2+ hours, restart in Safe Mode and try again
• Consider running CHKDSK first to fix disk errors: chkdsk C: /f /r

Advanced SFC Commands and Usage

Verify System Files Without Repairing

Command: sfc /verifyonly

Scans for corruption but doesn't attempt repairs. Useful for diagnostics when you want to know what's wrong without making changes immediately.

Scan and Repair a Specific File

Command: sfc /scanfile=C:\Windows\System32\kernel32.dll

Verifies and repairs only the specified file. Faster than full scans when you know exactly which file is problematic (from CBS.log analysis or error messages).

Verify a Specific File Without Repairing

Command: sfc /verifyfile=C:\Windows\System32\ntdll.dll

Checks if a specific file is corrupted without attempting repair. Good for testing before applying fixes.

View All SFC Commands

Command: sfc /?

Displays complete SFC help with all available switches and syntax.

SFC vs DISM vs CHKDSK: When to Use Each

These three tools address different types of system problems. Here's when to use each:

SFC (System File Checker)

Purpose: Repairs corrupted Windows system files

Use for: Application crashes, Windows feature errors, DLL errors, system instability

Scans: System files (DLLs, EXEs, SYS files)

Repair source: Component store (WinSxS folder)

Duration: 15-45 minutes

DISM (Deployment Image Servicing and Management)

Purpose: Repairs the Windows component store and system image

Use for: When SFC fails, Windows Update errors, component-based servicing issues

Scans: Component store integrity, Windows image health

Repair source: Windows Update servers or installation media

Duration: 10-30 minutes

Run before SFC: If SFC can't repair files

CHKDSK (Check Disk)

Purpose: Repairs filesystem corruption and bad sectors on hard drive

Use for: Disk errors, file system corruption, read/write errors, physical disk problems

Scans: Disk filesystem structure, file allocation tables, bad sectors

Repair source: Disk surface and filesystem metadata

Duration: 30 minutes to several hours (depending on drive size)

Run before DISM/SFC: If you suspect disk hardware issues

Recommended Troubleshooting Sequence:

1. Start with SFC: sfc /scannow
2. If SFC fails, run DISM: DISM /Online /Cleanup-Image /RestoreHealth
3. Then run SFC again: sfc /scannow
4. If still failing, check disk: chkdsk C: /f /r
5. After CHKDSK, repeat DISM and SFC

Common SFC Error Messages and Solutions

"Could not perform requested operation" (Most Common)

Cause: Windows Modules Installer service not running

Solution: Start the service (services.msc → Windows Modules Installer → Start)

"Windows Resource Protection found integrity violations"

Cause: System files are corrupted

Solution: Run DISM RestoreHealth, then run SFC again

"There is a system repair pending which requires reboot"

Cause: Previous repair requires restart to complete

Solution: Restart your computer and run SFC again

"Windows Resource Protection is unable to run"

Cause: Running in Windows Recovery Environment without proper syntax

Solution: Use offline SFC syntax: sfc /scannow /offbootdir=C:\ /offwindir=D:\Windows

Best Practices for System File Protection

• Run SFC quarterly: Preventive maintenance catches corruption early
• Always run as administrator: SFC requires full system access
• Don't interrupt scans: Let them complete even if they seem slow
• Run DISM before SFC: If you know component store is damaged
• Check CBS.log: Understand what was repaired for future reference
• Use Safe Mode for stubborn issues: Unlocks files in use during normal operation
• Keep Windows updated: Updates include component store improvements
• Back up before repairs: Create system restore point before major fixes
• Run after malware removal: Malware often corrupts system files
• Monitor results: If SFC finds issues repeatedly, investigate root cause (failing drive, malware, etc.)

Frequently Asked Questions

Q: How long does SFC take to run?

A: Typically 15-45 minutes on modern systems. SSD-based systems complete faster (15-25 minutes), while HDDs take longer (30-45 minutes). Severely corrupted systems or those with many files may take up to 60 minutes. The scan commonly appears to pause at 4%, 27%, 48%, and 73%—this is normal verification behavior, not a hang.

Q: Can I use my computer while SFC is running?

A: Yes, but it's best to avoid intensive tasks. Light web browsing and document editing are fine, but avoid installing software, running updates, or doing disk-intensive operations. These can interfere with SFC's ability to access and repair files, potentially causing the scan to fail or take longer.

Q: Will SFC delete my personal files?

A: No. SFC only affects Windows system files in protected folders (Windows, System32, etc.). Your documents, photos, downloads, and installed programs are completely safe. SFC has no access to user data folders and cannot modify personal files.

Q: Why does SFC keep finding the same errors every time I run it?

A: This indicates a persistent problem: (1) Failing hard drive continuously corrupting files—run drive diagnostics; (2) Active malware re-corrupting files—run thorough malware scan; (3) Component store itself is corrupted—run DISM RestoreHealth before SFC; (4) System drivers or third-party software conflicting with Windows files—update drivers or uninstall recently installed software.

Q: Can SFC fix boot problems or blue screens?

A: Sometimes. If boot issues or BSODs are caused by corrupted system files, SFC can resolve them. Run SFC from Windows Recovery Environment (offline scan) if Windows won't boot. However, if the problem is hardware failure, driver issues, or malware, SFC won't help—you'll need hardware diagnostics, driver updates, or malware removal respectively.