Skip to content
WinBookUnofficial

DISM and SFC: the right order, and how to read the result

Verified 1 min read

Use DISM CheckHealth/ScanHealth/RestoreHealth and SFC /scannow in the correct order, read CBS/DISM logs, and avoid the common myths.

Tested onPro (26H2) · Build 26300.9457 · x64
E1
Build
26300.9457
Edition
Pro (26H2)
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-28
Page type
Troubleshoot

The short answer

Section titled “The short answer”

Run DISM first, then SFC:

Terminal window
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

CheckHealth is a quick flag read, ScanHealth scans, RestoreHealth repairs using Windows Update/source files. SFC repairs protected system files after the component store is healthy.

Run from an elevated prompt. A non-elevated SFC will refuse or give misleading results.

What each tool does

Section titled “What each tool does”
Command Job Time Changes system?
DISM /CheckHealth Reports known corruption Seconds No
DISM /ScanHealth Scans component store Minutes No
DISM /RestoreHealth Repairs store 10–30+ min Yes
sfc /scannow Repairs protected system files 5–20 min Yes

Reading the result

Section titled “Reading the result”
  • No component store corruption detected — good; move to SFC.
  • The component store is repairable — run RestoreHealth.
  • Source files could not be found — DISM needs a matching source (ISO/install.wim) or Windows Update access.
  • Windows Resource Protection found corrupt files and repaired them — SFC fixed files; reboot and retest.
  • Found integrity violations but could not repair — read CBS.log; the file may be owned by a package/update.

Do not treat one SFC pass as proof of malware. SFC checks file integrity, not intent.

Offline repair

Section titled “Offline repair”

If Windows cannot boot, use WinRE and point DISM at an offline image:

Terminal window
DISM /Image:C:\ /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /LimitAccess

The index must match the installed edition (Home/Pro/Enterprise). Wrong index = wrong files. Mount the ISO in WinRE and use the correct drive letter.

Logs

Section titled “Logs”
  • C:\Windows\Logs\CBS\CBS.log
  • C:\Windows\Logs\DISM\dism.log

Search for error, the KB number, or the component name. A 20MB CBS log is normal; use Select-String or a log viewer, not Notepad scrolling.

When to stop repairing

Section titled “When to stop repairing”

If DISM and SFC both report unrecoverable corruption, or the disk has errors, stop. Back up, run chkdsk /scan, and consider a reset/reinstall. Repeated repairs on a failing disk waste time and risk data.

Sources