Fixing “Windows Resource Protection Found Corrupt Files”

31 Jul 2026

Running System File Checker is often one of the first steps recommended when Windows starts behaving strangely.

You may use it after experiencing:

Applications that will not open
Windows Update failures
Start menu or taskbar problems
Random crashes
Missing Windows features
File Explorer errors
Blue screens
General system instability

The scan reaches 100%, but instead of reporting a clean system, Windows displays one of these messages:

Windows Resource Protection found corrupt files and successfully repaired them.

or:

Windows Resource Protection found corrupt files but was unable to fix some of them.

The first result is generally good news. The second means System File Checker identified damaged or missing protected files but could not obtain a healthy replacement for everything it found.

That does not automatically mean Windows must be reinstalled. In many cases, repairing the Windows component store with DISM and then running SFC again resolves the problem.

What Is Windows Resource Protection?

Windows Resource Protection protects important operating-system files, folders and registry information from unauthorised or accidental changes.

System File Checker—usually run with the command sfc /scannow—checks protected system files and compares them with known-good copies stored by Windows.

When it finds a modified, damaged or missing file, it attempts to replace it automatically.

Microsoft describes SFC as a tool that scans protected system files and replaces corrupted files with cached copies.

What the Different SFC Results Mean

After running:

sfc /scannow

you will normally receive one of four broad results.

Windows Resource Protection did not find any integrity violations

No corruption was detected among the protected files checked by SFC.

This does not prove that every application, driver or data file is healthy. It only means SFC did not find a problem within the protected Windows files it examined.

Windows Resource Protection found corrupt files and successfully repaired them

SFC found damaged files and replaced them.

Restart Windows and run the scan again. The second result should ideally report no integrity violations.

Windows Resource Protection found corrupt files but was unable to fix some of them

SFC found damage but could not repair everything.

This frequently happens when the Windows component store—the source from which SFC obtains replacement files—is itself damaged or incomplete.

Windows Resource Protection could not perform the requested operation

The scan could not complete.

Possible causes include:

File-system problems
A pending repair
A damaged servicing component
Permissions problems
Windows being unable to access the required files

Microsoft recommends attempting the scan in Safe Mode when SFC cannot perform the requested operation.

Before Starting Repairs

Before running deeper repair commands:

Save open work
Restart the computer
Install any pending Windows updates
Confirm the system drive has sufficient free space
Back up important data
Connect a laptop to mains power
Do not interrupt repair commands once they are running

On a business computer, confirm that maintenance is permitted before making major changes or installing a repair version of Windows.

Step 1: Open Terminal as Administrator

Right-click the Start button and select:

Terminal (Admin)

Approve the User Account Control prompt.

You can also search for Command Prompt, right-click it and select Run as administrator.

The repair commands will not work correctly from a standard, non-elevated terminal.

Step 2: Run DISM RestoreHealth

When SFC cannot repair files, the next step is usually to repair the Windows component store with Deployment Image Servicing and Management.

Run:

DISM.exe /Online /Cleanup-Image /RestoreHealth

The spaces before each forward slash matter.

This command instructs DISM to:

Examine the running Windows installation
Check the component store for corruption
Obtain suitable replacement components
Repair damage where possible

Microsoft recommends running DISM before SFC when protected files cannot be repaired, because SFC relies on healthy Windows components as its repair source.

Do Not Assume DISM Has Frozen

DISM may appear to stop at a particular percentage for a long time.

It is common for it to remain at values such as:

20%
40%
62.3%
84.9%

Do not close the window unless the process has clearly failed or the entire computer has become unresponsive for an unusually long time.

The duration depends on:

Storage speed
System performance
Internet connectivity
The amount of corruption
Whether Windows must download replacement files
The condition of Windows Update

The /RestoreHealth operation scans the component store and performs repairs automatically.

Step 3: Restart Windows

When DISM reports:

The restore operation completed successfully.

restart the computer.

Restarting allows Windows to complete pending servicing work and release files that may have been locked during the previous session.

Step 4: Run SFC Again

Open Terminal as administrator and run:

sfc /scannow

Allow it to reach 100%.

The ideal result is now:

Windows Resource Protection did not find any integrity violations.

Alternatively, it may say that corrupt files were found and successfully repaired.

Restart and run SFC once more to confirm the system remains clean.

Should You Run SFC More Than Once?

Sometimes SFC repairs one layer of damage during the first scan and can repair additional files during the next.

A sensible sequence is:

DISM.exe /Online /Cleanup-Image /RestoreHealth

then:

sfc /scannow

Restart and run:

sfc /scannow

again.

Repeatedly running SFC many times without changing anything is unlikely to help. If the same files remain unrepairable after DISM and a restart, examine the logs or move to a stronger repair method.

Optional DISM Health Checks

DISM provides two diagnostic checks that can be useful before running a full repair.

CheckHealth

DISM.exe /Online /Cleanup-Image /CheckHealth

This checks whether Windows has already flagged the component store as corrupted and whether the damage is considered repairable.

It is a quick check rather than a full scan.

ScanHealth

DISM.exe /Online /Cleanup-Image /ScanHealth

This performs a more detailed scan for component-store corruption but does not repair it.

RestoreHealth

DISM.exe /Online /Cleanup-Image /RestoreHealth

This performs a scan and attempts repair.

For most users who have already received an SFC corruption warning, going directly to RestoreHealth is reasonable.

What If DISM Says the Source Files Could Not Be Found?

DISM normally uses Windows Update to obtain replacement components where necessary.

It may fail with an error such as:

0x800f081f

The source files could not be found.

This can happen when:

Windows Update is disabled or damaged
The computer is disconnected from the internet
A business update server does not contain the required files
The local component store is badly damaged
The repair source does not match the installed Windows version
The required optional-feature files are unavailable

You may need to provide a matching Windows installation source.

Using Windows Installation Media as a Repair Source

Download or create installation media that matches the installed edition, architecture, language and Windows release as closely as possible.

Mount the Windows ISO by double-clicking it, then note its drive letter—for example:

Look inside the Sources folder for one of these files:

install.wim

or:

install.esd

A repair command may then use a source similar to:

DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\Sources\install.wim:1 /LimitAccess

or:

DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:esd:D:\Sources\install.esd:1 /LimitAccess

The index number after the file path must correspond to the correct Windows edition inside the image. It is not always 1.

To list the available editions in a WIM file, run:

DISM.exe /Get-WimInfo /WimFile:D:\Sources\install.wim

For an ESD file:

DISM.exe /Get-WimInfo /WimFile:D:\Sources\install.esd

Then repeat RestoreHealth using the appropriate index.

The /Source option specifies known-good repair files, while /LimitAccess prevents DISM from attempting to use Windows Update.

Do not use installation media from an unrelated or substantially different Windows build.

Check the CBS Log

SFC records details in:

C:\Windows\Logs\CBS\CBS.log

This file contains a large amount of servicing information, so opening it directly can be difficult to interpret.

To create a smaller text file containing SFC entries, run:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\SFCdetails.txt"

This creates:

SFCdetails.txt

on the current user’s desktop.

Look for entries containing phrases such as:

Cannot repair member file

or:

Repairing corrupted file

Microsoft documents the CBS log as the place to examine files SFC could not repair and explains how to filter the relevant [SR] entries.

Do Not Treat Every CBS Entry as a Disaster

The CBS log can contain warnings and historical entries that do not represent an active fault.

Some entries may relate to:

Files already repaired
Earlier scans
Language components
Optional features
Files not protected by Windows Resource Protection
Expected differences introduced by updates
Temporary servicing activity

Focus on recent entries from the latest scan and on files repeatedly marked as unrepairable.

The presence of a complicated CBS log does not, by itself, prove that Windows needs reinstalling.

Check the Disk for Errors

System-file corruption may be caused by file-system or storage problems.

Run a non-disruptive online check:

chkdsk C: /scan

If Windows reports errors that require an offline repair, it may recommend:

chkdsk C: /f

Because the Windows drive is in use, you may be asked to schedule the repair for the next restart.

Save all work before agreeing.

A disk that repeatedly produces new corruption should be investigated rather than endlessly repaired.

Check Storage Health

Repeated system-file corruption can indicate:

A failing SSD or hard drive
Faulty memory
Unexpected power loss
Storage-controller problems
Firmware issues
Unsafe overclocking
Malware
Interrupted Windows updates

Warning signs include:

Files becoming damaged repeatedly
Disk errors in Event Viewer
Blue screens mentioning storage
Unusual clicking from a hard drive
Extremely slow file access
Windows repeatedly entering repair mode
SFC becoming corrupt again shortly after a successful repair

Back up important data immediately if hardware failure is suspected.

Install Windows Updates

After DISM and SFC complete successfully, check:

Settings > Windows Update

Install available updates and restart.

Updates may replace components, servicing-stack files and system binaries involved in the original corruption.

If Windows Update itself is failing, repair the component store first, then attempt the update again.

Try SFC in Safe Mode

If SFC cannot access a file because another process is using it, Safe Mode may allow the repair to complete.

To enter the recovery options:

Open Settings.
Select System.
Choose Recovery.
Under Advanced startup, select Restart now.
Choose Troubleshoot.
Select Advanced options.
Choose Startup Settings.
Select Restart.
Choose the appropriate Safe Mode option.

Once signed in, open an elevated terminal and run:

sfc /scannow

Restart normally afterwards.

Run SFC Offline from Windows Recovery

If Windows will not start correctly, SFC can be run against the offline Windows installation.

Enter Windows Recovery Environment and open Command Prompt.

First identify the correct Windows drive letter. In recovery mode, it may not be C:.

You can inspect the drives with:

diskpart

then:

list volume

Exit DiskPart with:

exit

Assuming Windows is on D: and the boot partition is also available, an offline scan may look like:

sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

The correct letters vary between computers.

Microsoft documents /offbootdir and /offwindir as options for repairing an offline Windows installation.

Avoid Downloading Individual DLL Files

When a log identifies a corrupt DLL, some websites suggest downloading a replacement copy manually.

Avoid this.

A DLL obtained from an untrusted source may be:

The wrong version
Modified
Incompatible with the installed build
Malicious
Missing its associated components
Incorrectly registered

Use DISM, Windows installation media or an in-place repair to restore authentic Windows files.

Avoid Taking Ownership of System Files Without a Plan

Manually replacing protected files may require changing ownership and permissions.

This can create additional problems if done incorrectly, including:

Broken updates
Security weaknesses
Incorrect permissions
Servicing failures
Further SFC errors

Manual replacement should be reserved for carefully diagnosed cases where the exact correct file, build and permissions are known.

For most systems, a repair installation is safer.

Check Whether Third-Party Software Is Causing the Damage

Security tools, customisation utilities, “debloating” scripts and system cleaners may modify protected Windows components.

Consider whether the issue began after using:

Registry cleaners
Driver-updater applications
Windows customisation tools
Debloating scripts
Antivirus removal tools
Unsupported themes
File replacement utilities
Aggressive optimisation software

Remove or reverse the relevant change before repairing Windows. Otherwise, the same software may damage the files again.

Test Another User Account

SFC repairs system-wide protected files, but some symptoms blamed on corruption may actually be limited to one user profile.

If SFC eventually reports no violations but the original issue remains, test a new local account.

If Windows works correctly in the new account, the problem may involve:

User-profile corruption
Per-user registry settings
Application configuration
Shell extensions
Cached data
Startup items

Do not keep repeating SFC for a profile-specific fault.

When to Use an In-Place Repair

An in-place repair reinstalls the current version of Windows while normally retaining personal files, installed applications and supported settings.

Consider it when:

DISM repeatedly fails
SFC always reports the same unrepairable files
Windows Update is also damaged
Core Windows features do not open
Multiple user accounts are affected
The component store cannot be repaired
Windows remains unstable after successful scans
A correct external repair source does not resolve the issue

Windows 11 may also offer a repair option through:

Settings > System > Recovery

Depending on the version and device management settings, there may be an option to reinstall the current version of Windows using Windows Update while preserving applications, files and settings.

Back up important data before any repair installation.

When a Clean Installation May Be Necessary

A clean installation is normally the final option.

It may be appropriate when:

The disk has been replaced
Malware may have compromised system files
Windows cannot be repaired or upgraded
The installation is heavily modified
The component store is non-repairable
An in-place repair fails
The computer has wider performance and reliability problems
There is no requirement to preserve the current application setup

A clean installation removes more of the existing environment, so licences, data, encryption keys and specialist software must be reviewed first.

A Safe Repair Order

Use this order when Windows Resource Protection reports corrupt files:

Back up important data.
Restart Windows.
Install pending updates where possible.
Run DISM /Online /Cleanup-Image /RestoreHealth.
Restart.
Run sfc /scannow.
Restart and run SFC again.
Review the CBS log if corruption remains.
Run chkdsk C: /scan.
Check storage and memory if corruption returns.
Use a matching Windows repair source if DISM cannot find files.
Try Safe Mode or an offline scan.
Perform an in-place repair if the component store remains damaged.
Consider a clean installation only after data is protected.

Need Help Repairing Corrupt Windows Files?

System-file corruption can be caused by failed updates, storage problems, damaged Windows components or third-party software. Running repair commands without investigating the underlying cause may only provide a temporary fix.

Hamilton Group can analyse SFC and DISM results, examine servicing logs, check storage health and repair Windows without unnecessarily wiping the computer.

Call 0330 043 0069 or visit hgmssp.com to speak with one of our IT experts.

Previous Next