How to Run DISM and SFC Safely: What They Actually Do (2026 Updated Guide)

Quick answer

DISM repairs the Windows component store. SFC repairs individual system files using that store as its source. Run them in that order — DISM first, then SFC — or you risk SFC repeatedly “fixing” files using a corrupted source. Both are built into Windows, neither requires a download, and neither will solve hardware faults. If they don’t fix your problem after one clean pass, the issue is somewhere else.

Before you start

Open an elevated terminal. Either Command Prompt (Run as administrator) or PowerShell (Run as administrator) works for both commands; we’ll use Command Prompt syntax throughout because it’s the version Microsoft documents. Standard PowerShell without administrator rights will refuse the operation, and that’s by design.

Don’t run DISM or SFC because a tech-support page told you to and you don’t know why. Both commands modify protected system files. Running them on a partly-broken system can extend a small problem into a longer one, particularly if you reboot mid-scan. If you’re already getting blue-screen crashes or boot failures, stop and read the CRITICAL_PROCESS_DIED diagnostic guide or recovery error 0xc0000225 guide first — those scenarios sometimes need DISM and SFC, but they need them inside a recovery environment with extra steps.

You don’t need a third-party “PC repair tool” to run these. Windows already has them. Anyone selling you a one-click wrapper around sfc /scannow is selling you the icon, not the function.

Back up anything you’d hate to lose before running DISM with the /RestoreHealth switch, particularly on a system that’s already been crashing. The probability of DISM making things worse is low, but it isn’t zero, and your backups should be current anyway.

What DISM and SFC actually do

The two tools are often quoted together — “run DISM and SFC” — as if they were one thing. They aren’t. Understanding the difference is the difference between using them properly and copy-pasting commands hopefully.

SFC (System File Checker) compares individual Windows system files on your machine against a known-good copy in the local component store. If a file is missing, modified, or corrupted, SFC replaces it. The command is sfc /scannow and it’s been part of Windows since the late 1990s.

DISM (Deployment Image Servicing and Management) operates one level higher. It maintains the component store itself — the local cache of known-good Windows files that SFC reads from. If the component store is damaged, SFC has nothing valid to replace bad files with. DISM repairs the store by checking the local copy, and if necessary downloading replacements from Windows Update.

This is why the order matters. Running SFC on a system with a damaged component store achieves nothing useful. SFC will report errors it can’t fix, you’ll Google the result, and end up running DISM anyway. Skip the wasted hour: DISM first, then SFC.

The full sequence is:

1. DISM /Online /Cleanup-Image /CheckHealth — quick check
2. DISM /Online /Cleanup-Image /ScanHealth — deeper scan
3. DISM /Online /Cleanup-Image /RestoreHealth — repair if needed
4. sfc /scannow — repair individual files using the now-clean store

Most guides skip steps 1 and 2 and jump straight to RestoreHealth. That’s not wrong, but the early steps are fast and they tell you whether the rest of the work is even necessary.

When to use them

DISM and SFC are appropriate when you suspect Windows system files are damaged. Specifically:

• After a Windows update fails with a non-specific error and you’ve already tried the Windows Update component reset
• When you’re getting one of the file-corruption-class blue screens (CRITICAL_PROCESS_DIED, KERNEL_SECURITY_CHECK_FAILURE, MEMORY_MANAGEMENT after RAM has tested clean)
• After a sudden power loss during a system update or large file operation
• When system features stop working without explanation — Action Center crashes, Windows Update won’t open, Settings closes itself
• Before considering a Windows reset or reinstall, as a last conservative step

They are not appropriate for:

• Slow performance, full disks, or boot-time delays. These have nothing to do with system file integrity. Running SFC on a slow PC is a folk remedy, not a diagnosis.
• Application crashes from third-party software. SFC only checks Windows system files; your accounting package isn’t one.
• Driver problems. Drivers live outside the scope of SFC. The driver IRQL guide covers the right approach.
• Hardware faults. A failing SSD, bad RAM, or overheating CPU will not be repaired by software running on top of them.

If your real problem is in one of those categories and you run DISM and SFC anyway, the commands will probably report “no integrity violations” and you’ll be no further forward. That’s a useful signal in itself, but don’t expect a fix.

DISM: step by step

Open Command Prompt as administrator. The taskbar search for “cmd” with right-click → Run as administrator is the fastest route. The window title should read “Administrator: Command Prompt” — if it doesn’t, close it and reopen with admin rights.

Step 1. Quick health check.

DISM /Online /Cleanup-Image /CheckHealth

This takes a few seconds. Three possible results:

• No component store corruption detected. You’re done with DISM. Move to SFC.
• The component store is repairable. Continue to step 3.
• The component store cannot be repaired. This is rare and usually points to deeper damage; skip ahead to “What to do if either fails.”

CheckHealth only reports flags Windows has previously set during routine integrity checks. It doesn’t actively scan. If it reports clean and you suspect damage anyway, run step 2.

Step 2. Deeper scan.

DISM /Online /Cleanup-Image /ScanHealth

This actively inspects the component store. It takes 5 to 15 minutes on most systems, longer on slow drives. Don’t cancel mid-scan. If it reports the store is repairable, proceed to step 3.

Step 3. Repair.

DISM /Online /Cleanup-Image /RestoreHealth

This is the one that does real work. DISM will pull replacement files from Windows Update, which means you need a working internet connection. The progress indicator hangs at 20% and 62.3% on most systems — that’s normal, not a fault, don’t reboot.

Total time runs from 15 minutes to over an hour depending on the size of the repair and your connection speed. The command writes to C:\Windows\Logs\DISM\dism.log and you can read it afterwards if you want to know what was replaced.

Offline source variant. If the machine has no internet connection or is on a tightly controlled network, you can point DISM at a local source — typically a mounted Windows ISO of the same version:

DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:D:\sources\install.wim:1 /LimitAccess

Replace D: with the drive letter of the mounted ISO. The version must match — running 23H2 source against a 24H2 install will fail or, worse, partially succeed in unhelpful ways.

SFC: step by step

Once DISM has finished cleanly — “The restore operation completed successfully” — run:

sfc /scannow

It takes 5 to 30 minutes. Don’t reboot or close the window mid-scan. The four possible outcomes:

• Windows Resource Protection did not find any integrity violations. Nothing was wrong, or DISM already cleaned everything that mattered.
• Windows Resource Protection found corrupt files and successfully repaired them. The fix worked. Reboot and verify the original problem is gone.
• Windows Resource Protection found corrupt files but was unable to fix some of them. The component store still has gaps. Run DISM again, then re-run SFC. If the second pass also fails, see “What to do if either fails.”
• Windows Resource Protection could not perform the requested operation. This is the unusual one. It usually means SFC can’t access something it needs — most commonly because you’re not actually running as administrator, or because the system is in a partly-broken state that requires booting into the recovery environment.

It’s worth running SFC twice if the first pass reports fixes. Some files depend on others; the second pass occasionally catches dependents the first pass repaired.

What to do if either fails

DISM and SFC are not magic. They fix one specific class of problem. When they don’t, the diagnosis is more useful than another scan.

DISM RestoreHealth fails to download replacements. Check that Windows Update itself is working. If updates are blocked at the network layer (corporate proxy, restrictive firewall, or paused updates), DISM will hit the same wall. Try the offline source variant above using a Windows ISO matching your build.

SFC reports errors it cannot fix, even after a clean DISM run. This points to damage in files that SFC doesn’t trust the component store to replace — usually because the corruption is on the boot partition or because the file system itself is damaged. Run chkdsk C: /f /r (it will require a reboot) before trying again. If SFC still fails after chkdsk, the underlying disk may be failing.

Both commands “complete” but the original problem persists. They’ve done their job; your problem is somewhere else. Common candidates: hardware fault (RAM, SSD, GPU), driver conflict, third-party software, or a configuration issue that lives outside the system files. Stop running DISM and SFC repeatedly — at this point you’re treating “ran SFC” as the diagnosis instead of using it.

The system won’t boot far enough to run them. You need the Windows Recovery Environment. Boot from a Windows installation USB, choose Repair your computer → Troubleshoot → Advanced options → Command Prompt. From there, the syntax changes slightly because you’re not running on the live system:

DISM /Image:C:\ /Cleanup-Image /RestoreHealth /Source:E:\sources\install.wim
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Drive letters in WinRE often differ from your normal Windows drive letters — use diskpart and list volume to confirm before running the commands. The recovery error 0xc0000225 guide walks through this in detail.

If you are on a work or school device

Stop. On a corporate-managed device, the component store may be locked down by Group Policy, and Windows Update may be controlled by WSUS or Intune rather than Microsoft’s public servers. Running DISM /RestoreHealth against a controlled update source can fail or, worse, pull files that don’t match your enterprise build.

Tell your IT helpdesk what’s happening. They’ll either run the command themselves with the correct source, or roll out a known-good system image. Both are faster than you guessing.

If you are the IT admin, run DISM with /Source: pointing at a confirmed-good image of the exact build. Don’t trust the public Windows Update path on a managed fleet — it bypasses your update governance.

When to stop

Stop running DISM and SFC when:

• You’ve completed one full clean pass (DISM RestoreHealth → SFC scannow → reboot) and the original problem persists. Repeated runs do not compound. If two passes haven’t fixed it, twenty won’t.
• The drive containing Windows is showing signs of failure — chkdsk reports bad sectors, SMART status is “caution” or “bad,” or the system is hanging on disk operations. Software repair on a failing drive can mask symptoms briefly while making the eventual data recovery harder.
• You don’t have a current backup of files you can’t replace. If something goes wrong during a repair, your last good backup is the safety net. No backup, no repair work — copy your files first.
• You’re being told by anyone, anywhere, that you must run a third-party “system optimiser” to make these work. You don’t. The commands are built into Windows. Anyone monetising the path to running them is monetising your confusion.

If you’ve reached the stopping point and the original problem is unresolved, the next conservative step is usually a Windows in-place upgrade — running Setup from the installation media and choosing “Keep personal files and apps.” This rebuilds the OS while preserving user data. It takes longer than a Reset This PC, but it’s reversible.

Related guides

• How to Reset Windows Update Components — the right tool when DISM RestoreHealth can’t reach Microsoft’s update servers
• CRITICAL_PROCESS_DIED: Safe Diagnostic Steps — when blue-screen crashes are the symptom that brought you here
• Recovery Error 0xc0000225 — running these commands from the recovery environment when Windows won’t boot

Official references

• Microsoft: Repair a Windows Image
• Microsoft: Use the System File Checker tool
• Microsoft: DISM Image Management Command-Line Options

FAQ

Should I run SFC or DISM first?

DISM first, then SFC. SFC repairs files using the component store; DISM repairs the component store itself. Running SFC against a damaged store is wasted effort.

How long should DISM RestoreHealth take?

Between 15 minutes and an hour on most modern systems. The progress indicator hangs at 20% and again around 62% — that isn’t a fault, it’s how the command reports work in chunks. If it sits unchanged for longer than an hour, your network connection or update source may be the problem.

Why does sfc /scannow say “Windows Resource Protection could not perform the requested operation”?

The most common cause is running Command Prompt without administrator rights. The second is the system being in a partly-broken state where the resource protection service can’t start. If you’re in the second case, run SFC from the recovery environment using the /offbootdir and /offwindir switches.

Will DISM and SFC fix a blue screen?

Sometimes — if the blue screen is caused by corrupted system files. They won’t fix blue screens caused by hardware faults, third-party drivers, overclocking, or recent Windows updates that introduced new bugs. Run them as one step in diagnosis, not as the diagnosis itself.

Do I need to reboot after running these?

Yes. Reboot before retesting whatever problem brought you here. Some file replacements only take effect after restart, and you want a clean slate to verify the fix.

Can I cancel them mid-scan?

You can, but don’t. Both commands modify protected files, and a half-complete operation can leave the component store in a worse state than it started. Wait it out, even when the progress indicator looks stuck.