What is the purpose of the DISM /RestoreHealth parameter and the SFC /ScanNow parameter?

  • How do they correlate to one another?
  • In what order should they be run?
  • Why does the order sequence matter when executing either?

The Component Store [%WinDir%\WinSxS] maintains a backup copy of all Windows system files; SFC and DISM manage two separate, vital pieces of the Component Store and OS, with SFC relying entirely upon what DISM manages.

  • DISM has two functions SFC relies upon, /StartComponentCleanup and /RestoreHealth, with /RestoreHealth relying solely upon /StartComponentCleanup
    • /StartComponentCleanup: Cleans the Component Store of any broken hard links
      (It's imperative folks on Insider Builds run this regularly due to the frequent updates)
    • /RestoreHealth: Verifies and fixes any corruption in the Component Store by verifying it's system file backups against known good copies from the Windows Update servers through hash comparison; while an offline method does exist [below], it may not always fix the corruption
      • Windows 7: SUR [System Update Readiness] tool is used in lieu of this, as Dism did not have this functionality until Windows 8

  • SFC always assumes the Component Store is not corrupted and is why the DISM /RestoreHealth parameter (Windows 7: SUR) should always be run prior to SFC; not doing so allows a corrupted Component Store to potentially replace a good system file with a corrupted one or fail to fix corruption within %WinDir% altogether
    • /ScanNow: Verifies and fixes any corruption within %WinDir% by verifying against the known good copies within the Component Store through hash comparison

DISM and SFC must be executed in the order listed, as each relies upon what the preceding does:
(Windows 7: skip to #3)

  1. WinKey+ROpen: PowerShellCtrl+Shift+OK
    # Windows ≥8:
      # Online (while booted to Windows):
        Dism /Online /Cleanup-Image /StartComponentCleanup
      # Offline (while booted to WinPE/WinRE):
        Dism /Image:"D:\Windows" /Cleanup-Image /StartComponentCleanup
        # C: is usually not the drive letter in WinPE/WinRE
        # To ascertain: DiskPart → Lis Vol → Exit
    The Component Store should always be cleaned prior to running Windows Update, after an issue with Windows Update, and at least once a month, as it becomes dirty over time from updates occasionally breaking hard links.

  2. # Windows ≥8:
      # Online (while booted to Windows):
        Dism /Online /Cleanup-Image /RestoreHealth
      # Offline (while booted to WinPE/WinRE):
        Dism /Image:"D:\Windows" /Cleanup-Image /RestoreHealth
    Requires an internet connection, else the offline method will be required:
    • Use the install.esd||install.wim from the Windows Install ISO for the installed version (v1909, v2004, etc.):
      1. Create Windows 10 installation mediaDownload tool nowinstall on another PC
      2. Mount the ISO and determine the installed OS index [image] from the install.esd||install.wim:
        Dism /Get-ImageInfo /ImageFile:"Z:\sources\install.esd"
      3. Specify the index number at the end of the /Source parameter:
        # Online (while booted to Windows):
          # ESD:
            Dism /Online /Cleanup-Image /RestoreHealth /Source:esd:"Z:\sources\install.esd":6 /LimitAccess
          # WIM:
            Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:"Z:\sources\install.wim":6 /LimitAccess
        # Offline (while booted to WinPE/WinRE):
          Dism /Image:"D:\Windows" /Cleanup-Image /RestoreHealth /Source:esd:"Z:\sources\install.esd":6 /LimitAccess

  3. Windows 7: Run the SUR tool
  4. Reboot; if errors are found, review %WinDir%\Logs\DISM\dism.log from the bottom up
    (Log files are easier to read and sift through via the Log syntax in VS Code)
    • Windows ≥8: %WinDir%\Logs\DISM\dism.log
    • Windows 7: %WinDir%\Logs\CBS\CheckSUR.log (How to fix SUR errors)

  5. # Online (while booted to Windows):
      Sfc /ScanNow
    # Offline (while booted to WinPE/WinRE):
      Sfc /ScanNow /OffBootDir=D:\ /OffWinDir=D:\Windows
      # C: is usually not the drive letter in WinPE/WinRE
      # To ascertain: DiskPart → Lis Vol → Exit

  6. Reboot; if errors are found, output to %UserProfile%\Desktop\SFCdetails.log and review:
    # Cmd:
      FindStr /c:"[SR]" "%WinDir%\Logs\CBS\CBS.log" > "%UserProfile%\Desktop\SFCdetails.log"
    # PowerShell:
      FindStr /c:"[SR]" "$env:WinDir\Logs\CBS\CBS.log" > "$env:UserProfile\Desktop\SFCdetails.log"

I run these weekly via Task Scheduler to help prevent random issues from occurring:

  1. Dism_ComponentCleanup.xml
    Executes weekly on Sundays at 11:30:00
  2. Dism_RestoreHealth.xml
    Executes weekly on Sundays at 12:00:00
  3. Sfc_ScanNow.xml
    Executes weekly on Sundays at 13:00:00

To import into Task Scheduler:

  • GUI:
    1. WinKey+R → Open: TaskSchd.msc
    2. ActionNew Folder... → Name: Custom
    3. ActionImport Task...<task_name>.xml

  • CLI:
    • Cmd:
      SchTasks /Create /Xml "%UserProfile%\Downloads\<task_name>.xml" /Tn "\Custom\Task Name" /Ru "%ComputerName%\%UserName%"
    • Powershell:
      Register-ScheduledTask -Xml (Get-Content '$env:UserProfile\Downloads\<task_name>.xml' | Out-String) -TaskName "Task Name" -TaskPath "\Custom\" -User $env:ComputerName\$env:UserName –Force
  • The section on StartComponentCleanup appears to be useful on my Windows Insider machine that is having some issue with the latest build. – John Aug 19 '20 at 13:38
  • Running StartComponentCleanup against the C:\Windows directory (which I checked with diskpart is the correct drive letter) fails and it logs that C:\Windows is not a WIM mount point. I'm running WinPE off a usb. What might the issue be? – pingOfDoom May 22 at 2:22
  • @pingOfDoom I need to do some research, as I'm getting errors on my end using /RestoreHealth, so either something changed or I overlooked a step since I use a custom-built WinRE/WinPE image and a standalone dism.exe from the ADK. – JW0914 May 22 at 11:37
  • This is an AWESOME POST but I have yet to see any of these tools fix anything whatsoever and I have been doing this a long time. (I originally used the SFC tool in Win2K.. where it came from). I have however wasted hours and hours of my time using them. I would love to hear from anyone EVER that found a solution by using them. – Señor CMasMas Jun 10 at 15:02
  • @SeñorCMasMas I'm not understanding the premise of the question - these commands fix corruption within the Component Store/system files, and when corruption is found and fixed, the output of the command and the CBS.log will detail what was replaced. If no corruption exists [hashes match], then corruption isn't the issue. To see what that looks like, please see the Review link or rename/delete a system file within %WinDir%, perform steps 5 & 6, and review the log output [or] (I wouldn't recommend the same with %WinDir%\WinSxS since it's not intended to be directly accessed by users). – JW0914 Jun 10 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.