Repair Windows from the Command Line: SFC, DISM and chkdsk (2026)

Verified June 2026 · tested on Windows 11 24H2, Windows 10 22H2 & Server 2022/2025

Quick Reference: Essential Commands

In a hurry? Run these three commands, in this order, from an elevated prompt:

# 1. Repair the component store (the source SFC copies from)
DISM /Online /Cleanup-Image /RestoreHealth

# 2. Repair protected system files using the now-healthy store
sfc /scannow

# 3. Only if you suspect disk / file-system corruption: schedule a disk check
chkdsk C: /f /r

# Quick, non-destructive health checks (no repair, safe to run anytime)
DISM /Online /Cleanup-Image /CheckHealth   # instant — reads existing flag only
DISM /Online /Cleanup-Image /ScanHealth    # full scan, reports but does not fix

Which command do you need?

• System files are corrupt / apps crashing → sfc /scannow
• SFC can't fix files / Windows Update broken → DISM /RestoreHealth
• Disk errors, bad sectors, file-system corruption → chkdsk /f /r
• No internet / repairing an offline image → Offline & boot-time repair

The golden rule: DISM → SFC → chkdsk. SFC repairs system files by copying known-good versions out of the Windows component store (WinSxS). If that store is itself damaged, SFC fails with "unable to fix some of them." DISM repairs the store, so run it first.

sfc /scannow: Repair System Files

sfc.exe (System File Checker) scans every protected Windows system file and replaces any that are corrupt, missing, or altered with a cached copy from the component store. It is the fastest first response to crashing apps, missing DLLs, and blue screens caused by damaged OS files.

Windows 10Windows 11Server 2016+Built in — no module⚠ Requires elevation

sfc Switch Reference

sfc Usage Examples

# Standard repair of all protected system files
sfc /scannow

# Check files without changing anything (read-only audit)
sfc /verifyonly

# Repair just one file
sfc /scanfile=C:\Windows\System32\kernel32.dll

# Repair an offline Windows installation mounted on D:
sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

When SFC finishes you will see one of these messages:

• "Windows Resource Protection did not find any integrity violations." — System files are healthy.
• "Windows Resource Protection found corrupt files and successfully repaired them." — Fixed. Reboot and re-run sfc /scannow once more to confirm a clean pass.
• "Windows Resource Protection found corrupt files but was unable to fix some of them." — The component store is damaged. Run DISM /RestoreHealth, then sfc /scannow again.
• "Windows Resource Protection could not perform the requested operation." — Run SFC from Safe Mode, and make sure the PendingDeletes and PendingRenames folders exist under %WinDir%\WinSxS\Temp.

Note: SFC must run from an elevated Command Prompt or PowerShell. Launch it as Administrator, or it will exit immediately with "You must be an administrator running a console session."

Reading the CBS.log

SFC writes every action to the Component-Based Servicing log at %WinDir%\Logs\CBS\CBS.log. To pull out just the SFC [SR] entries into a readable file on your desktop:

findstr /c:"[SR]" %WinDir%\Logs\CBS\CBS.log > "%UserProfile%\Desktop\sfcdetails.txt"

Open sfcdetails.txt and search for Cannot repair member file to see exactly which files SFC could not fix — that list tells you whether DISM solved the problem after a re-run.

DISM: Repair the Component Store

DISM.exe (Deployment Image Servicing and Management) services the Windows image itself — including the component store (C:\Windows\WinSxS) that SFC depends on. When SFC reports files it can't repair, DISM is what fixes the source those files come from.

Windows 10Windows 11Server 2016+Built in — no module⚠ Requires elevation

DISM /Cleanup-Image Switch Reference

The three health commands, in order of effort

# Instant — just reports a previously stored flag, does NOT scan
DISM /Online /Cleanup-Image /CheckHealth

# A few minutes — actually scans the store and reports corruption, no repair
DISM /Online /Cleanup-Image /ScanHealth

# The real fix — full scan AND repair from Windows Update
DISM /Online /Cleanup-Image /RestoreHealth

Only /RestoreHealth repairs anything. /CheckHealth is near-instant because it merely reads a flag DISM set on a previous scan; /ScanHealth does the work of looking but stops short of fixing. A typical workflow is: run /ScanHealth to confirm there is a problem, then /RestoreHealth to fix it.

/RestoreHealth can sit at 20% or 62.3% for several minutes — this is normal, not a hang. By default it downloads replacement files from Windows Update, so the machine needs internet access and a working Windows Update client. If Windows Update itself is broken, supply your own source — see Offline & boot-time repair.

After DISM reports "The restore operation completed successfully," go back and run sfc /scannow — DISM fixed the store, and SFC now has clean files to copy from. DISM logs to %WinDir%\Logs\DISM\dism.log.

chkdsk: Repair the Disk

chkdsk.exe (Check Disk) verifies the integrity of a volume's file system and metadata, and optionally scans the physical surface for bad sectors. SFC and DISM repair files; chkdsk repairs the structure those files live in. Reach for it when you see file-system errors, drives that won't mount, or "the file or directory is corrupted and unreadable."

Windows 10Windows 11Server 2016+Built in — no module⚠ Requires elevation

chkdsk Switch Reference

chkdsk Usage Examples

# Read-only check of the C: drive (reports problems, fixes nothing)
chkdsk C:

# Fix file-system errors on C: (will prompt to schedule at next boot)
chkdsk C: /f

# Fix errors AND scan for bad sectors on C: (slow; schedules at next boot)
chkdsk C: /f /r

# Fix a removable / secondary drive immediately by forcing a dismount
chkdsk E: /f /x

# Modern, low-downtime path on NTFS: scan online, fix the few flagged issues fast
chkdsk C: /scan
chkdsk C: /spotfix

Warning: chkdsk /f, /r, and /x modify the file system and can take a volume offline. /x forcibly dismounts the volume, immediately invalidating every open file handle — never run it against a drive with unsaved work or active applications. Always back up important data before running a repair pass, especially /r on a disk you suspect is physically failing, since reading a dying drive end-to-end can hasten its failure.

Why C: always reschedules to boot

You cannot run /f or /r against the live system drive because Windows holds an exclusive lock on it. chkdsk will ask:

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Answer Y and reboot; chkdsk then runs during early boot, before Windows loads, when it can take an exclusive lock. To confirm a check is queued — or cancel one — use the dirty-bit utility:

# Is a boot-time check already scheduled for C:?
fsutil dirty query C:

# Cancel a pending boot-time chkdsk on C:
chkntfs /x C:

chkdsk writes its results to the Application event log under the source Wininit (Event ID 1001) — that is where to find the report after a boot-time run, since the on-screen text disappears when Windows starts.

Offline and Boot-Time Repair

When Windows won't boot, or Windows Update is too broken for /RestoreHealth to download files, repair from a known-good source or from the recovery environment.

DISM /RestoreHealth from your own source

Mount a Windows ISO of the exact same version, edition and build and point DISM at its install.wim (or install.esd). /LimitAccess stops DISM from also trying Windows Update:

# Repair from index 1 of an install.wim on the D: drive, no Windows Update
DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccess

# Same idea with a compressed install.esd
DISM /Online /Cleanup-Image /RestoreHealth /Source:esd:D:\sources\install.esd:1 /LimitAccess

Note: The source must match your installed build. Use DISM /Get-WimInfo /WimFile:D:\sources\install.wim to list the editions inside the image and pick the index whose edition (Pro, Home, Enterprise) matches yours. A mismatched source silently fails to repair the store.

Repairing from the Windows Recovery Environment (WinRE)

Boot from Windows installation media or hold Shift while clicking Restart, then choose Troubleshoot → Advanced options → Command Prompt. In WinRE the system volume is not the running OS, so it usually mounts as D: (and X: is the RAM disk). Confirm with diskpart → list volume, then repair offline:

# Repair an offline image's component store (Windows is on D:)
DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:wim:E:\sources\install.wim:1 /LimitAccess

# Repair offline system files (boot dir and Windows dir on D:)
sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

# Fix the disk while it is fully offline (safe — nothing is using it)
chkdsk D: /f /r

Because the volume is offline in WinRE, chkdsk D: /f /r runs immediately without scheduling a reboot — this is the cleanest way to repair the system disk.

Troubleshooting: Common Repair Messages

Each row is deep-linkable — share a specific message with …#sfc-unable, and the row highlights on arrival.

Version and Compatibility Notes

• Windows 11 / 10: sfc, DISM, and chkdsk behave identically across modern builds. The DISM/SFC/chkdsk order applies to every supported version.
• Windows Server 2016–2025: All three tools ship in-box. On Server, DISM /RestoreHealth can also use an internal WSUS or local source if Windows Update is blocked — supply it via /Source.
• NTFS vs. ReFS/FAT: /scan, /spotfix, and /b are NTFS-only. On ReFS, the file system self-heals and chkdsk's repair switches are unnecessary; on FAT/exFAT use the basic /f.
• SSDs: prefer chkdsk /f (file-system fix) over /r. The /r surface scan was designed for spinning disks; on SSDs it adds long read passes with little benefit.
• Logs to keep: SFC → %WinDir%\Logs\CBS\CBS.log; DISM → %WinDir%\Logs\DISM\dism.log; chkdsk → Application event log, source Wininit, Event ID 1001.
• Always elevate: every repair command here requires an Administrator console. Right-click Command Prompt or Windows Terminal and choose Run as administrator before you start.