# DISM and SFC: the right order, and how to read the result

> Use DISM CheckHealth/ScanHealth/RestoreHealth and SFC /scannow in the correct order, read CBS/DISM logs, and avoid the common myths.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-28

## The short answer

Run **DISM first**, then **SFC**:

```bat
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
```

`CheckHealth` is a quick flag read, `ScanHealth` scans, `RestoreHealth` repairs using Windows Update/source files. SFC repairs protected system files after the component store is healthy.

Run from an **elevated** prompt. A non-elevated SFC will refuse or give misleading results.

## What each tool does

| Command | Job | Time | Changes system? |
|---|---|---|---|
| `DISM /CheckHealth` | Reports known corruption | Seconds | No |
| `DISM /ScanHealth` | Scans component store | Minutes | No |
| `DISM /RestoreHealth` | Repairs store | 10–30+ min | Yes |
| `sfc /scannow` | Repairs protected system files | 5–20 min | Yes |

## Reading the result

- **No component store corruption detected** — good; move to SFC.
- **The component store is repairable** — run RestoreHealth.
- **Source files could not be found** — DISM needs a matching source (ISO/install.wim) or Windows Update access.
- **Windows Resource Protection found corrupt files and repaired them** — SFC fixed files; reboot and retest.
- **Found integrity violations but could not repair** — read CBS.log; the file may be owned by a package/update.

Do not treat one SFC pass as proof of malware. SFC checks file integrity, not intent.

## Offline repair

If Windows cannot boot, use WinRE and point DISM at an offline image:

```bat
DISM /Image:C:\ /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /LimitAccess
```

The index must match the installed edition (Home/Pro/Enterprise). Wrong index = wrong files. Mount the ISO in WinRE and use the correct drive letter.

## Logs

- `C:\Windows\Logs\CBS\CBS.log`
- `C:\Windows\Logs\DISM\dism.log`

Search for `error`, the KB number, or the component name. A 20MB CBS log is normal; use `Select-String` or a log viewer, not Notepad scrolling.

> **Caution: Do not run “sfc /scannow” in a loop**
>
> If SFC cannot repair a file, running it ten times changes nothing. Read CBS.log and fix the source/package. Also do not delete CBS logs while servicing is running.

## When to stop repairing

If DISM and SFC both report unrecoverable corruption, or the disk has errors, stop. Back up, run `chkdsk /scan`, and consider a reset/reinstall. Repeated repairs on a failing disk waste time and risk data.

## Sources

- [Microsoft — DISM /RestoreHealth](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-operating-system-package-servicing-command-line-options)
- [Microsoft — SFC](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sfc)

---

Source: https://winbook.fyi/en/windows/fixes/dism-sfc/