Windows sfc Command Explained

What SFC does

System File Checker (sfc.exe) verifies critical Windows system files against the trusted catalog and, when you request a scan that allows repair, replaces corrupted copies using the component store under WinSxS. That store is maintained by Component-Based Servicing (CBS)—the same subsystem DISM talks to—so a damaged store means SFC may report failures even when individual files look wrong.

Commands you actually use

Invocation	Behavior	Notes
`sfc /scannow`	Scan all protected system files; repair where possible	Requires elevated Administrator; can take many minutes
`sfc /verifyonly`	Verify only—no repairs	Useful for audits or read-only diagnostics
`sfc /scanfile=<path>`	Repair a specific file if it fails verification	Path must be under protected namespaces CBS tracks
`sfc /verifyfile=<path>`	Verify one file without changing it	Pairs with targeted troubleshooting

DISM first, then SFC (usually)

If the component store is inconsistent—updates interrupted, disk errors, malware—sfc /scannow may end with “found corrupt files but was unable to fix.” Run DISM repair online first (for example DISM /Online /Cleanup-Image /RestoreHealth with a working Windows Update path or an explicit /Source WIM/ESD), reboot if prompted, then rerun SFC. DISM rebuilds the repair source SFC depends on.

Logs and evidence

Console text is a summary only. The authoritative trace is %windir%\Logs\CBS\CBS.log (large, verbose). From an elevated command prompt, findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log surfaces many of the System File Checker summary lines Microsoft documents for quick triage—still correlate timestamps with your run.

Offline and edge cases

For a system that will not boot normally, Windows Recovery or WinPE can run SFC against the offline image with /offbootdir and /offwindir pointing at the affected installation’s boot volume and Windows directory. BitLocker-encrypted volumes must be unlocked first. Some corruption (deep registry hives, third-party filter drivers) is outside SFC’s scope—repair-install or clean deployment may remain the honest fix.

Frequently Asked Questions

Q.Do I need to run sfc as Administrator?

Yes. Open Command Prompt or PowerShell as Administrator (elevated UAC). Without elevation, SFC typically cannot access protected resources and will fail early.

Q.Should I run DISM before sfc /scannow?

If SFC reports it could not repair files, or you suspect update corruption, run DISM /Online /Cleanup-Image /RestoreHealth (with a valid repair source if Windows Update is unavailable), reboot if needed, then run sfc /scannow again.

Q.Where is the SFC log?

Detailed activity is in %windir%\Logs\CBS\CBS.log. The console only summarizes Windows Resource Protection results; use findstr on [SR] lines in CBS.log for a concise repair trail.

Q.What is the difference between sfc /verifyonly and sfc /scannow?

/verifyonly checks integrity without replacing files—useful for reporting. /scannow performs verification and repairs eligible protected files from the component store.

Q.SFC says it repaired files—do I need to reboot?

Often yes if in-use binaries were scheduled for replacement. If Windows prompts for a restart or pending component operations exist, reboot before declaring victory and rerun a quick /verifyonly if you need confirmation.

Q.Why does SFC still fail after DISM succeeded?

Some files are not serviced the same way, hardware storage may be failing, or non-Microsoft binaries replaced system files. Review CBS.log for specific HRESULTs, check disk health, scan for malware, and consider in-place repair or reinstall if corruption persists.

Q.Can I run SFC on an offline Windows drive from another PC?

Yes from Windows RE or WinPE using sfc /scannow with /offbootdir and /offwindir pointing at the offline installation, after mounting the volume and satisfying BitLocker unlock requirements.

Q.Does SFC fix slow networking or browser issues?

Only if the root cause is corrupted Windows system files SFC covers. It does not reset TCP/IP stacks by itself, remove malware, or fix third-party apps—scope expectations accordingly.