When Windows starts misbehaving in vague ways — apps crashing, updates failing, settings that won’t open — the cause is often corrupted system files. The two built-in tools for fixing that are DISM and SFC, and they’re the first thing any experienced tech reaches for before considering a reinstall.
The trick most guides get wrong is the order. Run them backwards and you’ll waste time, or watch SFC report it “couldn’t fix some files” and have no idea why. Get the order right and these two commands repair a large share of Windows file corruption without losing a thing. This guide explains what each tool actually does, the correct sequence, how to read the log when something can’t be fixed, and how to repair Windows when even the repair source is broken.
What each tool does
They sound interchangeable. They aren’t. They operate on different layers.
DISM vs SFC
| SFC (System File Checker) | Scans protected Windows system files and repairs bad ones from a local cache held in the component store. |
|---|---|
| DISM (RestoreHealth) | Services and repairs the component store itself, pulling fresh correct files from Windows Update when needed. |
The key relationship: SFC repairs Windows files using the component store as its source. If that store is itself damaged, SFC has nothing good to copy from. DISM is the tool that repairs the store. That single fact dictates the order you run them in.
The correct order: DISM first, then SFC
Run DISM /RestoreHealth to make sure the component store is healthy, then run SFC so it has a clean source to repair from.
Open an elevated terminal (right-click Start → Terminal (Admin) or Command Prompt (Admin)) and run:
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannowThat’s the whole core procedure. /Online means “operate on the running Windows installation.” Wait for DISM to finish completely before starting SFC — don’t run them in parallel.
The DISM commands in more detail
/RestoreHealth is the one that repairs. The other two are diagnostic and quick, useful if you just want to know whether there’s a problem before committing to the longer repair:
DISM /Online /Cleanup-Image /CheckHealth # fast: reports if corruption was already flagged
DISM /Online /Cleanup-Image /ScanHealth # slower: actively scans for corruption
DISM /Online /Cleanup-Image /RestoreHealth # scans AND repairs from Windows UpdateIf you’re in a hurry and just want it fixed, skip straight to /RestoreHealth — it scans and repairs in one pass.
After SFC runs: reading the result
When sfc /scannow finishes it prints one of a few messages. Here’s what each means and what to do next.
SFC results, decoded
| Did not find any integrity violations | No corruption in protected files. Look elsewhere for the problem. |
|---|---|
| Found corrupt files and successfully repaired them | Fixed. Reboot and retest. |
| Found corrupt files but was unable to fix some | Store was likely still bad — re-run DISM, then SFC again. If it persists, go offline. |
| Windows Resource Protection could not perform the operation | Try running SFC from Safe Mode or the recovery environment. |
The one that worries people is “found corrupt files but was unable to fix some of them.” Nine times out of ten that means SFC’s source — the component store — is still damaged. The answer is to make sure DISM /RestoreHealth actually completed successfully, then run SFC once more. It’s common to need a second pass.
Reading the CBS log
When SFC can’t fix something, the detail of what lives in the CBS log. The raw file is enormous and painful to read directly, so filter out just the SFC (“System Restore”) entries into a clean text file:
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > %userprofile%\Desktop\sfcdetails.txtThat drops a readable sfcdetails.txt on your desktop listing each file SFC checked and whether it repaired it. The full log lives at:
C:\Windows\Logs\CBS\CBS.logLook for lines mentioning files that “cannot repair” — they name the exact component that’s broken, which tells you whether the damage is something minor or a core system file that warrants an offline repair.
Standard repair run
- Terminal opened as administrator
- DISM /RestoreHealth run and allowed to reach 100%
- sfc /scannow run after DISM finished
- SFC re-run a second time if the first couldn't fix everything
- CBS log filtered to sfcdetails.txt if files remain unfixed
- Rebooted and retested the original problem
When DISM can’t reach Windows Update: offline repair
DISM /RestoreHealth normally downloads its replacement files from Windows Update. But if Windows Update is itself broken — which is often why you’re repairing — DISM has no source and fails. The fix is to give it a known-good source manually.
You’ll need a Windows ISO that matches your installed edition and build (a Windows 11 23H2 Pro install needs a 23H2 source, not an older one). Download the ISO, then mount it (right-click → Mount) so it gets a drive letter.
Inside a mounted ISO the image is install.wim or install.esd in the sources folder. Point DISM at it and tell it not to fall back to Windows Update:
# Assuming the mounted ISO is drive E:
DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:E:\sources\install.wim:1 /LimitAccess/Source tells DISM where to get good files, the :1 is the image index (use the index that matches your edition), and /LimitAccess stops it from trying Windows Update at all. If the source is an install.esd instead, swap wim: for esd:.
Repairing a Windows that won’t boot
If Windows won’t start at all, you can run DISM against the offline installation from the recovery environment or a boot USB, using /Image instead of /Online:
DISM /Image:C:\ /Cleanup-Image /RestoreHealth /Source:wim:E:\sources\install.wim:1 /LimitAccessHere /Image:C:\ points at the offline Windows drive (the letter may differ in the recovery environment — check with diskpart or notepad’s open dialog). This lets you repair a system that can’t boot far enough to run the online version.
When SFC and DISM aren’t enough
These tools repair file corruption. They don’t fix everything, and it’s worth knowing their limits so you don’t keep re-running them expecting a different result:
- Driver problems, registry damage, and misconfiguration aren’t protected system files, so SFC won’t touch them.
- If DISM can’t repair the store even from a good offline source, the corruption may be deeper than file-level, and an in-place upgrade repair (running setup.exe from an ISO and choosing “keep files and apps”) rebuilds Windows while preserving your data.
- If you arrived here chasing a specific symptom like a stuck Windows Update, run the repair, then go back and retry the original task — DISM and SFC fix the cause, but they don’t re-trigger the update for you.
Wrapping up
DISM and SFC are the right first response to corrupted Windows files, and the order is the whole game: DISM /RestoreHealth repairs the component store, then sfc /scannow uses that healthy store to fix protected files. Run them the other way and you’ll fight the “couldn’t fix some files” message for no reason.
When the standard online repair can’t reach Windows Update, point DISM at a build-matched ISO with /Source and /LimitAccess. And if even a good offline source can’t repair the store, stop re-running commands and move to an in-place upgrade repair — it’s faster than chasing damage these tools were never meant to fix.
