SFC and DISM: The Correct Order to Repair Windows 11 (2026 Guide)

SFC and DISM: The Correct Order to Repair Windows 11 (2026 Guide) | PCFixHub

I’ve been repairing PCs professionally for sixteen years. In that time, I’ve watched countless people run sfc /scannow, see the dreaded “found corrupt files but was unable to fix some of them” message, and then give up — or, worse, reinstall Windows when they didn’t have to. The frustrating part is that SFC often fails not because it’s broken, but because it was run in the wrong order.

Windows 11 has two built-in repair tools that almost every guide mentions: SFC (System File Checker) and DISM (Deployment Image Servicing and Management). Both are genuinely powerful. Both are free and already on your machine right now. But the order in which you run them is everything. Run them backward and the second tool is flying blind. Run them in the correct order and you give Windows the best possible chance to fix itself without a reinstall.

In this guide I’m going to explain what each tool actually does, why the order matters, and walk you through every command — including what to do when Windows won’t boot. I’ll keep the technical jargon minimal, but I won’t oversimplify either. If you follow this guide start to finish, you’ll know more about SFC DISM repair commands Windows 11 than most IT support technicians.

Section 1: What SFC and DISM Actually Do

Before you run any commands, it helps to understand exactly what each tool is working on. They sound similar — both fix Windows files — but they operate at completely different layers of the operating system.

SFC: The Factory Worker

SFC (System File Checker) scans all protected Windows system files and compares each one against a known-good reference copy. If it finds a file that has been modified, corrupted, or deleted, it replaces it. The reference copies it uses for those replacements are stored in what’s called the Windows Component Store — a special protected directory at C:\Windows\WinSxS. SFC doesn’t download anything from the internet. It relies entirely on those local reference files to do its repairs.

Think of SFC as a factory worker whose job is to replace defective products on the assembly line. It’s good at its job — but only as long as the parts warehouse (the component store) contains good parts.

DISM: The Factory Itself

DISM (Deployment Image Servicing and Management) works one level deeper. Instead of fixing individual system files, DISM repairs the component store that SFC depends on. If the component store itself has become corrupted — which happens more often than people realize, usually from failed Windows Updates or partial upgrades — SFC has nowhere to pull clean replacement files from. It tries, fails, and tells you “unable to fix some of them.”

DISM is the factory. SFC uses the factory to fix the products. If the factory is broken, none of the products will come out right — no matter how many times the worker tries.

When DISM runs its /RestoreHealth command, it contacts Windows Update servers (or a local source you specify) to download verified, clean component files and rebuild the component store. Only once that store is healthy can SFC do its job properly.

Section 2: The Correct Order (And Why)

The correct order is: DISM first, then SFC.

Almost every popular guide gets this backward, or runs them simultaneously, or just says “run both” without explaining sequence. Here’s why the order is non-negotiable:

SFC pulls replacement files from the component store. If the component store contains corrupted entries, SFC either can’t repair the files it finds, or — in some cases — replaces good files with bad ones from the corrupted store.
DISM repairs the component store. It reaches out to Microsoft’s update servers, verifies file integrity, and replaces anything that’s wrong. After DISM finishes, the component store is trustworthy.
Once the store is clean, SFC can finally do its job. It now has a verified source for every replacement file it needs.

Running SFC before DISM is like asking that factory worker to grab parts from a warehouse you know has bad inventory. Even if they work hard, the results will be unreliable. Run DISM first, restock the warehouse with good parts, then let SFC do the assembly line pass.

The correct workflow — confirmed by Microsoft documentation and repeated by technicians across the industry — is:

Run DISM /CheckHealth
Run DISM /ScanHealth
Run DISM /RestoreHealth
Run sfc /scannow

That’s it. Four commands, one reboot, and in most cases your Windows 11 installation is back to health. Let’s walk through each one.

Section 3: Running DISM Step by Step

First, you need an elevated Command Prompt. Right-click the Start button, select Terminal (Admin) or search for cmd, right-click it, and choose Run as administrator. Click Yes on the UAC prompt. You should see a command window with the path ending in System32.

Command 1: CheckHealth

DISM /Online /Cleanup-Image /CheckHealth

This is a quick read-only check. DISM looks at flags in the component store to determine whether any corruption has already been logged. It does not scan deeply or fix anything — it simply reads the metadata Windows has been tracking. This command finishes in under a minute.

If the result says “No component store corruption detected,” you can technically skip ahead, but I always run all three DISM commands anyway. CheckHealth’s metadata can miss things that ScanHealth catches.

Command 2: ScanHealth

DISM /Online /Cleanup-Image /ScanHealth

This command does a full scan of the component store. It doesn’t rely on previously logged flags — it actively compares every file. Expect this to take 5 to 15 minutes depending on your drive speed. Do not close the window while it runs.

When it finishes, it will report one of three results:

“No component store corruption detected” — The store looks healthy.
“The component store is repairable” — Corruption found; proceed to RestoreHealth.
An error code — Usually means a permissions issue or the command wasn’t run as admin.

Command 3: RestoreHealth

DISM /Online /Cleanup-Image /RestoreHealth

This is the heavy-lifting command. DISM identifies every corrupted or missing component store file, then reaches out to Windows Update to download verified replacements. If your internet connection is active and Windows Update is working normally, DISM handles everything automatically.

Expect 10 to 30 minutes for this command to complete. You’ll see a progress percentage that sometimes appears to stall — especially around 20% and 62%. That’s normal. Do not close the window. Some people have waited 45 minutes on slower connections and it still completed successfully.

When it finishes, you should see: “The restore operation completed successfully.”

If you’re offline or behind a corporate proxy: DISM won’t be able to reach Windows Update. In that case, mount a Windows 11 ISO and point DISM at it as a local source:

DISM /Online /Cleanup-Image /RestoreHealth /Source:esd:E:\sources\install.esd:1 /LimitAccess

Replace E: with the actual drive letter of your mounted ISO. The /LimitAccess flag prevents DISM from going online, forcing it to use only your local source.

Once DISM completes successfully, you’re ready for SFC.

Section 4: Running SFC Step by Step

With the component store repaired, SFC now has a clean source to draw from. In that same elevated Command Prompt, run:

sfc /scannow

SFC will scan every protected system file on your Windows 11 installation. Expect 5 to 20 minutes. Again — don’t close the window. When it finishes, you’ll see one of three messages:

Result 1: “Windows Resource Protection did not find any integrity violations.”

Good news. No corrupted system files were found. If you’re still experiencing issues, they’re not caused by file-level corruption — look elsewhere (drivers, hardware, startup programs).

Result 2: “Windows Resource Protection found corrupt files and successfully repaired them.”

This is the ideal outcome. SFC found problems and fixed them. Restart your computer. In most cases, whatever symptoms you were experiencing — slow boot, crashes, update failures, broken Windows features — will be resolved.

Result 3: “Windows Resource Protection found corrupt files but was unable to fix some of them.”

This is the frustrating one. It means SFC found corruption but couldn’t fully repair it, even after DISM cleaned up the component store. A few things to try:

Run SFC a second time. Seriously — sometimes a second pass fixes what the first pass couldn’t, because the first pass repaired files that the second pass then uses as a source.
Check the CBS log (covered in the next section) to find out exactly which files couldn’t be repaired.
Run SFC from the recovery environment offline (covered in Section 6), which can fix files that are locked while Windows is running.

Section 5: When SFC and DISM Fail

Sometimes DISM and SFC complete without errors but the original problem persists. Or SFC keeps reporting files it can’t repair. Here’s what to do next.

Check the CBS Log

Every SFC scan writes a detailed log to C:\Windows\Logs\CBS\CBS.log. This file contains the exact names of every file that SFC scanned, which ones were corrupted, and whether they were repaired. It’s verbose — hundreds of lines — so I use this command to filter just the relevant lines:

findstr /c:"[SR]" C:\Windows\Logs\CBS\CBS.log > C:\Users\Public\sfclog.txt

Open sfclog.txt in Notepad. Look for lines containing “Cannot repair member file” — those will tell you exactly which files SFC couldn’t fix. Armed with that information, you can manually replace specific files from a mounted ISO or consider an in-place upgrade repair.

DISM Log

DISM writes its own log to C:\Windows\Logs\DISM\dism.log. If DISM itself failed or reported partial completion, check this log for error codes and specific failure points.

In-Place Upgrade Repair

If both DISM and SFC have run successfully but your system is still misbehaving, the nuclear option (short of a clean install) is an in-place upgrade repair. Download the Windows 11 ISO from Microsoft’s website, mount it, and run setup.exe from within Windows. Choose Keep personal files and apps. This reinstalls every system file while preserving your data, applications, and settings. It takes 30–90 minutes but is far less disruptive than a clean install.

Note: if you’re seeing general performance issues rather than outright file corruption, also check out our guide on common causes of a slow Windows 11 system — file corruption is only one possible culprit.

Section 6: Running SFC and DISM Offline (When Windows Won’t Boot)

If Windows 11 won’t boot at all, or boots to a black screen or blue screen loop, you can still run DISM and SFC — you just need to do it from the Windows Recovery Environment (WinRE), booted from a USB drive.

You’ll need a Windows 11 installation USB. Create one using the Media Creation Tool from Microsoft on a working PC.

Step 1: Boot from USB

Insert the USB drive, restart the broken PC, and press the boot menu key (usually F12, F9, or Esc — check your motherboard or laptop manufacturer’s documentation). Select the USB drive. When the Windows Setup screen appears, click Next, then Repair your computer at the bottom left. Navigate to Troubleshoot → Advanced options → Command Prompt.

Step 2: Identify the Correct Drive Letter

Inside the recovery environment, drive letters are reassigned. Your main Windows drive is probably not C: anymore — it’s often D: or E:. Use diskpart to find out:

diskpart
list volume
exit

Look for the volume labeled Windows or the one with your Windows partition size. Note the drive letter assigned — let’s say it’s D: for this example. The USB installer is typically E: or F:.

Step 3: Run DISM Offline

DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:esd:E:\sources\install.esd:1 /LimitAccess

Replace D: with your Windows drive letter and E: with your USB drive letter. If your USB has an install.wim instead of install.esd, swap the filename accordingly. The /Image:D:\ flag tells DISM to target the offline Windows installation rather than the currently running environment.

This command will take time — potentially 20–40 minutes. Let it run.

Step 4: Run SFC Offline

Once DISM completes, run SFC with the offline switches:

sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

The /offbootdir parameter points to the root of the Windows drive, and /offwindir points to the Windows folder itself. SFC will scan and repair the offline installation without needing Windows to be running.

When both commands finish, type exit, remove the USB drive, and restart the PC. In most cases, Windows will boot successfully.

If hardware-related issues like overheating are contributing to your boot failures, check our guide on fixing HP laptop overheating — thermal problems can cause corruptions that even offline repair can’t fully address until the underlying hardware issue is resolved.

Section 7: One-Liner Script for Regular Maintenance

Running DISM and SFC manually every few months is a good habit, but it’s easy to forget. I use a simple batch file to run both tools in the correct order automatically. Here’s the script:

@echo off
echo ========================================
echo  Windows 11 System Repair - PCFixHub
echo ========================================
echo.
echo [1/4] Running DISM CheckHealth...
DISM /Online /Cleanup-Image /CheckHealth
echo.
echo [2/4] Running DISM ScanHealth...
DISM /Online /Cleanup-Image /ScanHealth
echo.
echo [3/4] Running DISM RestoreHealth...
DISM /Online /Cleanup-Image /RestoreHealth
echo.
echo [4/4] Running SFC scannow...
sfc /scannow
echo.
echo ========================================
echo  Repair sequence complete. Reboot now.
echo ========================================
pause

How to Use This Script

Open Notepad and paste the code above.
Click File → Save As. Set Save as type to All Files. Name the file win_repair.bat. Save it somewhere easy to find, like your Desktop.
Right-click the file and choose Run as administrator. Do not double-click it normally — the admin elevation is required.
The script runs all four commands in the correct order and pauses at the end so you can read the output. When it’s done, reboot your PC.

Scheduling It Automatically

For a set-and-forget approach, use Windows Task Scheduler to run the script monthly:

Press Win + R, type taskschd.msc, and press Enter.
In the right panel, click Create Basic Task.
Name it Monthly Windows Repair and click Next.
Set the trigger to Monthly and choose a day and time (I use the first Sunday of each month at 2:00 AM).
Set the action to Start a program. Browse to your win_repair.bat file.
On the final screen, check Open the Properties dialog and click Finish.
In Properties, under the General tab, select Run with highest privileges and set Configure for: Windows 10/11. Click OK.

That’s it. Once a month, while you’re asleep, your system runs a full DISM and SFC cycle automatically. You’ll notice over time that Windows Update errors become less frequent and system performance stays more consistent.

Conclusion

After sixteen years of repairing Windows machines, I’m still surprised how often the solution is as simple as running two built-in tools in the right order. DISM and SFC together form the most powerful free repair toolkit Windows has ever had. But like any tool, they only work if you use them correctly.

Here’s the summary to put on a sticky note if you need it:

DISM first — it repairs the component store (the factory).
SFC second — it repairs individual system files using the now-clean store (the products).
If that doesn’t work: check CBS.log, try offline mode, then consider an in-place upgrade repair.
If Windows won’t boot: use a USB, run DISM /Image: and sfc /scannow /offbootdir= /offwindir=.

Most Windows 11 issues — crashes, failed updates, broken Microsoft Store, missing features — trace back to corrupted system files. Before you spend hours reinstalling everything, give DISM and SFC their shot. In my experience, this sequence resolves the problem at least 70% of the time.

If you’ve run through this entire guide and are still stuck, drop a description of your issue in the comments and I’ll do my best to help.

— Richard Anderson, owner of Cincinnati PC Repair LLC