sfc /scannow on Windows: run it right and fix 'could not repair' errors

Windows tends to break in ways that look unrelated: the Start menu stops opening, a built-in app refuses to launch, the machine reboots for no obvious reason. Before I reinstall anything, I run two built-in tools in a fixed order. Budget about 20 minutes of hands-on work — the scans themselves run unattended, and how long they take depends on your disk and on how much is damaged.

Before you start: a five-item checklist

• Windows 10 or 11. Both sfc and DISM ship with the OS. Run winver to note your build, because the wording of the result lines differs between builds and interface languages.
• An account in the Administrators group. Both tools write into protected system locations, so a normal prompt gives you Access is denied and you waste a full scan.
• An elevated window — the title bar starts with Administrator:.
• Internet access for the DISM step only. sfc /scannow reads the local component store and runs fine offline.
• Your BitLocker recovery key, stored somewhere other than the encrypted drive, in case a repair forces a reboot that asks for it before Windows starts.
• A reboot window. A successful repair ends with a restart, so do not start this five minutes before a meeting.

Step 1: Open an elevated prompt and prove it is elevated

Press Win + X and choose Terminal (Admin) on Windows 11 or Windows PowerShell (Admin) on Windows 10, then confirm the UAC prompt. On older builds: Start, type cmd, right-click Command Prompt, pick Run as administrator.

Then verify instead of trusting the title bar:

net session

An elevated window answers with an empty session list:

C:\Windows\system32>net session
There are no entries in the list.

If you get an access-denied error, stop and reopen the window:

System error 5 has occurred.

Access is denied.

Step 2: Run sfc /scannow and decode the last line

sfc /scannow

SFC (System File Checker) compares every protected system file against a known-good copy and replaces the damaged ones from the local component store. It goes first because it fixes most corruption without touching the network. Leave the window open and do not close it while the verification percentage is moving.

The final line tells you which branch you landed on:

Line on screen	What it means	What to do next
did not find any integrity violations	Nothing is damaged	Go to Step 3 to confirm the source
found corrupt files and successfully repaired them	Files were replaced	Restart, then re-check
found corrupt files but was unable to fix some of them	The source of the good copies is damaged too	Go to Step 3
could not perform the requested operation	The scan was interrupted or blocked	See troubleshooting below

If files were repaired, reboot right away so the replaced binaries are actually loaded:

shutdown /r /t 0

Step 3: Repair the source with DISM, then scan again

This is the part people skip. sfc does not download anything — it copies from the local component store. When that store is damaged as well, there is no good copy to restore from, which is exactly what the "unable to fix some of them" message means.

DISM /Online /Cleanup-Image /RestoreHealth

DISM (Deployment Image Servicing and Management) rebuilds the system image that sfc copies from. That is why the two commands are used as a pair: SFC fixes the live system, DISM fixes the source. /Online targets the running installation, /RestoreHealth performs the repair, and the command needs administrator rights plus a working connection.

Wait for the completion line, something like:

[==========================100.0%==========================]
The restore operation completed successfully.
The operation completed successfully.

Then run the checker again and read the result:

sfc /scannow

A clean scan or a successful repair is what you want. Restart the PC and judge by behaviour: if the original symptom — random crashes, a broken Start menu, a feature that will not open — is gone, you are done. If it survives a clean scan, the cause sits outside the system-file layer, and repeating the same command will not help.

Troubleshooting the three failures I see most

SFC finds damage but cannot repair it. This is the classic store problem. Run DISM /Online /Cleanup-Image /RestoreHealth from the elevated window with the network connected, rerun sfc /scannow, then shutdown /r /t 0.

The scan dies immediately. The could not perform the requested operation line usually means the scan was interrupted — the window was closed, the machine restarted mid-scan, another servicing operation was still running, or the prompt was not elevated. Close other maintenance tools, restart, reopen the window as administrator, confirm with net session, and try again. If it fails the same way, open C:\Windows\Logs\CBS\CBS.log and read the first error entry in the newest scan block.

DISM stops with Error: 0x800f081f and The source files could not be found. That points at connectivity: no working internet connection, a proxy, or a firewall blocking the download. Test with ping -n 2 www.microsoft.com, drop the proxy for the session or let the tool through the firewall, and rerun. If the same error comes back, the /Source option lets you point DISM at files from installation media instead of the network.

Takeaway

Run sfc /scannow from an elevated prompt, reboot if it repaired anything, and fall back to DISM /Online /Cleanup-Image /RestoreHealth plus a second SFC pass when it admits it could not fix everything. Keep the BitLocker key within reach before you start, and treat a clean scan with a surviving symptom as a signal to look somewhere else rather than to loop the same command.

This article was originally published on AI Release — https://ai-release.org — where I keep longer step-by-step Windows guides; shorter notes and updates land in the channel at https://t.me/ai_release1.