SFC and DISM are distinct Windows repair utilities that address system file corruption through different mechanisms. SFC/Scannow replaces damaged local files using a cached copy within the component store, while DISM/Cleanup-Image/Restore Health repairs the underlying component store itself by downloading fresh files from Windows Update. Understanding this hierarchy is critical for effective troubleshooting.
How SFC Scannow Works
The System File Checker (SFC) tool is designed to scan protected system files on your computer and replace incorrect versions with correct Microsoft versions. It operates primarily on the local file system, checking integrity against a trusted source stored locally on the machine. When you run
sfc /scannow, the utility iterates through all protected Windows files, comparing their digital signatures and hashes against the known good copies.
These trusted copies reside in the Component Store, located at
C:\Windows\WinSxS. This directory acts as a backup library for essential operating system components. If SFC detects a corrupted or missing file, it attempts to restore it directly from this local cache. The process is fast because it does not require an internet connection or external servers. However, its effectiveness is limited by the health of that local cache. If the source files in the WinSxS folder are also damaged, SFC cannot repair the issue because it lacks a clean reference point.
The Role of DISM Restore Health
Deployment Image Servicing and Management (DISM) serves as a deeper diagnostic and repair layer than SFC. Specifically, the
Dism /Online /Cleanup-Image /RestoreHealth command targets the Windows Component Store itself. Its primary function is to verify and repair the integrity of the component store rather than individual system files. This tool determines if the local cache is corrupt and, if so, seeks replacement files from an external source.
By default, DISM connects to Windows Update to download healthy copies of the necessary components. This makes it particularly useful when the local WinSxS folder is compromised. Unlike SFC, which relies on potentially broken backups, DISM reaches out to Microsoft's servers to fetch pristine versions of the files needed to fix the component store. Once the component store is restored to a healthy state, subsequent runs of SFC can successfully use these repaired files to fix actual system file errors.
When to Use Each Tool
You should typically start with SFC because it is less intrusive and faster. It resolves minor corruptions without consuming bandwidth or requiring network connectivity. However, if SFC reports that it found corrupt files but was unable to fix them, this indicates that the local source is damaged. In this specific scenario, you must proceed to DISM. Running DISM first is generally unnecessary unless you suspect deep-level component store issues or are working in a restricted environment where Windows Update access is problematic.
DISM Shows Good but Windows Update Fails on Windows 11 explores scenarios where the component store is healthy but external sources are inaccessible, highlighting the dependency of DISM on network availability.
Execution Steps and Diagnostics
To perform these repairs effectively, you must open Command Prompt as an administrator. Right-click the Start button and select "Terminal (Admin)" or "Command Prompt (Admin)" depending on your Windows version. Ensure no other applications are running during the process, as file locking can interrupt repairs.
For SFC, enter the following command:
sfc /scannow
Wait for the process to complete. The output will indicate whether no integrity violations were found, violations were found and repaired, or violations were found but could not be repaired. If the latter occurs, note the error code for further investigation.
If SFC fails, execute the DISM command:
Dism /Online /Cleanup-Image /RestoreHealth
This process may take longer than SFC, often completing within ten to twenty minutes depending on your internet speed and the size of the updates required. You might see progress percentages. Once finished, run SFC again to ensure the system files are now correctly restored using the freshly repaired component store.
WDI WiFi.sys Suddenly Causing Crashes and BSODs? Here's What to Do demonstrates how specific driver corruption can mimic system file errors, sometimes requiring additional steps beyond standard repair tools.
Common Pitfalls and Best Practices
Users often attempt to run these commands repeatedly without success. It is important to understand that if DISM cannot connect to Windows Update, it will fail to repair the component store. In such cases, you can specify an alternative source using the
/Source flag, pointing to a mounted ISO image of the same Windows version. This bypasses the need for online connectivity.
Another common mistake is ignoring the reboot requirement. After running DISM, a restart is often recommended to allow the system to fully integrate the repaired components before attempting final SFC checks. Additionally, ensure your disk has sufficient free space. The Component Store can grow significantly, and lack of space can prevent DISM from writing new files.
Frequently Asked Questions
Can I run DISM and SFC simultaneously?
No, you cannot run both tools at the same time because they both require exclusive access to protected system files and the component store. Running them concurrently will result in errors indicating that the files are in use. Always complete one process and close the command prompt before starting the next.
What does it mean if SFC finds violations but cannot fix them?
This message indicates that the local backup files in the WinSxS folder are also corrupted. Since SFC relies on these local copies as the source of truth, it cannot replace a bad file with another bad file. This is the primary signal that you need to use DISM to repair the component store itself before SFC can succeed.
Does DISM delete my personal files or data?
No, neither SFC nor DISM modifies user data, documents, photos, or installed applications. These tools only interact with protected Windows system files and the component store. Your personal data remains completely safe during the scanning and repairing processes.
Why does DISM fail even with a working internet connection?
DISM failures often stem from mismatched Windows versions between the installation media and the OS, or from blocked firewall rules preventing access to Windows Update servers. Ensuring that your system is fully updated prior to running DISM can also resolve compatibility issues with the component store metadata.
Is there a way to repair the component store offline?
Yes, you can use the
/Source parameter in the DISM command to point to a local source, such as a mounted Windows ISO image. This allows you to repair the component store without relying on Windows Update, which is useful for systems with restricted network access or update service failures.