How to Run SFC /Scannow on Windows 11
Short answer: Open Terminal as admin and run them in order: DISM /Online /Cleanup-Image /RestoreHealth first (it repairs the component store SFC pulls from), then sfc /scannow. Running SFC alone often fails because its own source files are corrupted. If SFC says it could not fix everything, check CBS.log, run it again after a reboot, or do an in-place repair upgrade.
Right-click Start, Terminal (Admin). DISM first, then SFC:
DISM /Online /Cleanup-Image /RestoreHealthsfc /scannowDISM takes five to twenty minutes, SFC another five to fifteen. Don’t close the window during SFC.
Why DISM First
I ran SFC first on a machine once and it replaced three DLLs with corrupted copies. The component store — C:\Windows\WinSxS\ — was damaged from the same interrupted update that caused the problem, so SFC was pulling broken files to “fix” the system. DISM repairs the component store by downloading clean copies from Microsoft. After that SFC actually has something good to work with.
The thing that damages WinSxS is almost always a power loss during Windows Update. Laptops mostly, because people close the lid mid-update. I had one come in where the owner’s cat knocked the charging cable out during 24H2. Battery was at 6%. Some DLLs got the new version, some still had the old one, a few were just truncated. Took two rounds of DISM + SFC.
Same machine came back three weeks later with different corrupted files. That time I stopped looking at SFC and checked the drive — failing NVMe. If corruption keeps coming back in different files each time, stop running SFC and check your drive health first. Run chkdsk C: /r while you’re at it.
Reading the Results
“No integrity violations” — clean. “Successfully repaired” — restart. “Could not perform the requested operation” — you’re not admin, or Windows Modules Installer is disabled in services.msc.
“Found corrupt files but was unable to fix some of them” is the one that scares people. Had a client ready to buy a new laptop over it. Usually just means DISM didn’t run first, or certain DLLs are locked because Windows is using them right now. Boot into Safe Mode and run sfc /scannow there — Safe Mode releases most locked files.
The details are in C:\Windows\Logs\CBS\CBS.log but don’t open it in Notepad, it’s enormous. Run findstr /c:“[SR] Cannot repair” %windir%\Logs\CBS\CBS.log instead. You get output like:
2025-11-14 09:17:18, Info CSI 00000387 [SR] Beginning Verify and Repair transaction
2025-11-14 09:17:19, Info CSI 00000388 [SR] Verify complete
2025-11-14 09:17:22, Info CSI 00000389 [SR] Cannot repair member file [l:22]"mshtml.dll" of Microsoft-Windows-InternetExplorer
2025-11-14 09:17:22, Info CSI 0000038a [SR] This component was referenced by [l:126]"Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~~11.0.22621.1"
2025-11-14 09:17:23, Info CSI 0000038b [SR] Cannot repair member file [l:18]"oleaut32.dll" of Microsoft-Windows-OLE
2025-11-14 09:17:23, Info CSI 0000038c [SR] Verify completemshtml.dll is legacy Internet Explorer stuff that Microsoft still ships with Windows 11. I keep waiting for them to remove it and they never do. explorer.exe shows up a lot too, which is why File Explorer stops responding on machines with corrupted system files. oleaut32.dll handles COM/OLE automation — clipboard depends on it, so when that one’s corrupted copy-paste stops working until SFC replaces it. After botched driver updates you see driver-related DLLs.
What you’re looking for in the log is a pattern. A few files from one update package means a one-time interrupted update — fixable. Random files from different packages every time you scan means the drive is going bad and SFC isn’t going to save you.
Safe Mode, Offline, Nuclear Option
Already mentioned Safe Mode above. If that doesn’t fix the stubborn files either, you can run SFC from completely outside Windows — hold Shift, click Restart, Troubleshoot, Advanced options, Command Prompt, then run sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows. Check your drive letter first with dir C:\Windows because the recovery environment sometimes swaps C and D.
In-place upgrade is the last resort. Download the Windows 11 ISO, mount it, run setup.exe, “Keep personal files and apps.” Replaces every system file, keeps your data, 30-60 minutes. I ended up doing this on a machine after three rounds of DISM + SFC failed to fix ntdll.dll. Should’ve just started there.
One more thing — if SFC keeps finding corruption and you fix it but it comes back, check for malware before running SFC again. Malware modifies system DLLs, SFC replaces them, malware re-infects them immediately. Pointless loop.
Maintenance
Don’t run SFC on a schedule. It’s diagnostic, not maintenance. Run it when something’s actually wrong — freezes, missing DLL errors, update failures, blue screens.
After 23H2, 24H2, or any big semi-annual update, a quick DISM + SFC is worth ten minutes though. Those updates replace hundreds of files. If you’re not sure whether your problem is corruption or something else, we can check it remotely and tell you either way.
Frequently Asked Questions
Should I run SFC or DISM first?
Run DISM first, always. DISM repairs the component store (WinSxS) that SFC uses as its source of clean files. If you run SFC first and the component store is damaged, SFC either fails or 'repairs' files using corrupted copies — making things worse. Run DISM /Online /Cleanup-Image /RestoreHealth, wait for it to finish, then run sfc /scannow.
What does 'Windows Resource Protection found corrupt files but was unable to fix some of them' mean?
It means SFC detected corrupted system files but couldn't replace them. The most common reason is a damaged component store — run DISM /Online /Cleanup-Image /RestoreHealth first, then run SFC again. If that doesn't work, try SFC in Safe Mode, then from Windows Recovery Environment. The specific damaged files are listed in C:\Windows\Logs\CBS\CBS.log — use findstr /c:"[SR] Cannot repair" to filter the log.
Is it safe to run SFC /scannow?
Yes, completely safe. SFC only replaces corrupted or modified system files with known-good copies from the component store. It doesn't delete personal files, uninstall programs, or change settings. The scan takes 5-15 minutes and you can use your computer normally afterward. The only thing to avoid is interrupting the scan — don't restart or close the window while it's running.
How long does SFC /scannow take?
Usually 5 to 15 minutes, depending on your drive speed and how many files need checking. On an SSD it's typically closer to 5 minutes; on an older spinning hard drive, closer to 15. If SFC gets stuck at a specific percentage for more than 30 minutes, it may be trying to repair a particularly stubborn file — let it run for up to an hour before considering it stuck. DISM takes 5-20 minutes depending on your internet connection speed.
Should I run SFC /scannow regularly as maintenance?
No. SFC is a diagnostic tool, not a maintenance tool. Run it when you have symptoms — random crashes, missing DLL errors, apps that suddenly stop working, Windows Update failures. Running it on a schedule wastes time on scans that come back clean. The one exception: after major semi-annual Windows Updates (23H2, 24H2), a quick DISM + SFC check is worth the ten minutes to catch problems early.
What do I do if DISM also fails?
If DISM /Online /Cleanup-Image /RestoreHealth fails, it usually means the download from Windows Update servers was interrupted or your internet connection dropped. Try again with a stable connection. If it still fails, you can use a Windows 11 ISO as an offline source: mount the ISO, then run DISM /Online /Cleanup-Image /RestoreHealth /Source:E:\Sources\install.wim (replace E: with your mounted ISO drive letter). If that fails too, an in-place upgrade repair is your next step.