What command scans, detects, and restores important windows system files, folders, and paths?

When Windows 10 gets wonky, try this series of repair techniques — in this order — to attempt to set things right.

Table of Contents

Show More

Sometimes a Windows 10 system starts misbehaving to the point where repair is needed. This often takes the form of worsening performance or stability, and can originate from damage to, loss of, or corruption of Windows system files typically found in the C:\Windows folder hierarchy. When that happens, users would be well advised to break out the following routine to help them set things back to rights.

I initially wrote this story in 2016, but as Windows 10 has evolved over time, some of the steps have changed a bit. I’ve now updated it for the latest versions of Windows 10. That said, most of these approaches also work with Windows 7 and 8 (with slight variations), and the advice here applies almost identically to Windows 11, which Microsoft is gradually rolling out to Windows 10 users whose hardware can support the new OS via Windows Update from October 2021 into early 2022.

The Windows 10 (or 11) repair drill

The idea is to first try the initial step in the sequence. If that doesn’t fix what’s broken, advance to the next step. Keep working through the steps in order until you reach the end, and you are bound to fix the vast majority of problems. (The only remaining step at that point would be to replace the system on which the software is running, and that’s outside the scope of this story.)

The amount of time and effort required for each step goes up incrementally. Some steps involve additional work to restore the prior state of your PC more or less back to where it was prior to taking that step. Thus, the most important bit of advice I can dispense for those who must venture beyond Step 1 is this: make a complete backup of your system to provide a source for files and information that might otherwise go missing. Ignore this advice at your own risk.

Step 1: Using DISM and SFC for system repair

Since I wrote the original version of this story, I’ve obtained direct advice from Microsoft that it’s best to run DISM before running the System File Checker, a.k.a. SFC. Hence, I am reversing the order of events for this step. I’ll echo Microsoft and say “Always run DISM first, then SFC second, not vice versa.”

DISM is the Deployment Image Servicing and Management tool. It’s a kind of Swiss Army knife for working with Windows operating system images, both offline and online. DISM can often fix things that SFC can detect but that it cannot itself fix. DISM supports a raft of capabilities with switches and parameters to match, but basic system file repair syntax is reasonably easy (though it often requires multiple passes before it can set things straight).

You must run DISM in an Administrator: Command Prompt window (press the Windows key + X combination and select Command Prompt (Admin) from the resulting pop-up menu) or in an Administrative PowerShell or Windows Terminal session. Here’s some sample syntax (consult the TechNet DISM Technical Reference for all the gory details):

dism /online /cleanup-image /checkhealth

Most of the time when you run this command, the output will find nothing amiss, as shown in Figure 1:

Figure 1: DISM can check the health of any Windows image. Here, it reports all is well on a production PC.

The /checkhealth command simply checks the running image (that’s what /online tells it to do) to see if it can detect any damage or corruption. Because it’s only checking file hashes and signatures, this command completes in under one minute on most machines. The good thing about /checkhealth is that it not only tells you if it finds damage but if that damage is repairable or non-repairable. If it’s repairable, you can proceed to the /restorehealth option (covered in the following paragraphs); if it’s non-repairable, jump to Step 2.

If DISM reports that component store corruption is found and is repairable, you should attempt repairs. That syntax reads:

dism /online /cleanup-image /restorehealth

Even if errors were detected in the preceding step, this command should complete successfully. It replaces corrupt or questionable elements in the Windows Side-by-Side (WinSxS) store, reading from a local copy of your Windows image files.

The /restorehealth command can be tricky to use. Because it can actually repair a Windows image, it needs a source from which to attempt such repairs. You can omit the /source option, but if you do, the command will try to grab its files from Windows Update over the internet. This may or may not work, depending on firewall settings on your network.

A safer bet is to point DISM at a known good source for Windows image components on the local machine (or on your local network). This can be a Windows image (.wim) file or a compressed Windows image (.esd, which is used for electronic software downloads of Windows installations, as the file extension is meant to communicate). You can also point to a separate copy of a WinSXS folder (the usual directory path is C:\Windows\WinSXS) taken from another PC with similar or identical hardware for which dism ... /checkhealth returns a clean bill of health.

The syntax for image files is where things can get interesting. To point to the install.wim file that shows up in ISO downloads for the Windows 10 installer on a USB flash drive designated L:, for example, you must use the following source specification (which uses the first image it finds inside the .wim file, designated :1):

/source:WIM:L:\sources\install.wim:1

To use an ESD file, change the wim items to esd, as shown here:

/source:ESD:L:\sources\install.esd:1

If you run into difficulties getting this to work, try adding the /limitaccess switch to your command strings. This stops DISM from attempting to grab source files from Windows Update, which it will sometimes do even if pointed at a local source. If you just can’t get either of these to work, try a WinSXS folder instead.

Note: the version and language for the /source image must be identical to that for the image to be repaired. This may mean using HeiDoc.net, UUP Dump, or Microsoft’s Media Creation Tool to grab the correct Windows 10 or 11 version/build (see my article “The best places to find Windows 10 ISOs” for details on how to use these sources) and creating media or mounting the ISO file to give DISM the right /source from which to work. For Windows 11, check the Windows Insider Preview Downloads page to grab the proper ISO.

Figure 2 shows typical DISM output using /restorehealth:

Figure 2: Even when DISM /checkhealth finds errors, the /restorehealth option is usually successful. (Click image to enlarge it.)

Next, it’s time to run SFC, Microsoft’s System File Checker. To quote TechNet, the system file checker “scans and verifies versions of all protected system files.” It can tell you if it finds anything amiss if you enter SFC /scannow at the command line.

As with DISM, you must run SFC from an Administrator: Command Prompt or an Administrative PowerShell or Windows Terminal session. This command takes 5 to 10 minutes to complete, depending on your PC hardware. Unlike DISM, SFC scans and initiates repairs within a single command.

Figure 3 shows sample output when SFC finds files in need of repair. If this occurs on your PC, repeat the /scannow command until it gives the clear bill of health shown in Figure 4.

Figure 3: If SFC finds questionable files, it will repair them if it can. Here, it succeeds. (Click image to enlarge it.)

Figure 4: Eventually, SFC will report finding no “integrity violations.” You’re done! (Click image to enlarge it.)

In my experience, 80% of all problems will be solved at this point, so the odds are in your favor that you won’t have to keep going. But if DISM can’t fix your Windows image, or SFC can’t or won’t make repairs to your system files, proceed to Step 2.

Step 2: Try a recent restore point or image backup

A restore point is a snapshot of a Windows PC’s OS state from a specific point in time. If enabled, the Windows System Restore capability can create and maintain restore points on your behalf. To see if this is an option on your target machine, type restore point into the Windows 10 search box. The System Properties window should open to the System Protection tab, shown in Figure 5.

Figure 5: Access available restore points using the “System Restore…” button.

To look at restore points, you must work through the System Restore wizard. Click the System Restore... button to launch the wizard, then click the Next button on the first pane of the wizard to see a list of restore points available to you. (If you don’t like what you see, or you don’t see something from before your troubles started on this machine, click the Show more restore points checkbox for a complete list of what’s available to you.) Click the restore point to which you would like to revert.

Figure 6 shows the lone restore point available on my test PC.

Figure 6: For this story, I created a restore point named “Test restore point.”

Because I have only one restore point — I don’t use them much any more, for reasons I’ll explain coming up — I picked that item to show you what appears when you select a restore point in this utility. If you click the Scan for affected programs button it will tell you if any programs or drivers will be affected by rolling back to the restore point you’ve selected. In this case, there’s no impact, as shown in Figure 7. If something were to be affected, it would show up in either the top or bottom list in that results pane.

Figure 7: The current restore point has no impact. But older restore points will provide a list of drivers and programs that need to be reinstalled if you revert to that restore point.

It usually takes between 5 and 15 minutes to revert to a restore point. The amount of additional effort to catch back up to where you left off depends on the number of items that need to be installed or updated, as shown in Figure 7. This can take from minutes to an hour or more depending on size and scope.

All this said, I don’t use Restore Points anymore. I’ve run into occasional issues with failed restores, and I’ve seen plenty of discussion in Microsoft Community and TenForums among other users who’ve had similar problems. My preference is to restore an image built using Macrium Reflect (free or commercial; I use both). It’s faster than System Restore, and I’ve never been unable to restore a valid, integrity-checked Reflect backup. You decide what’s best for you; I use Reflect.

Restoring an image backup is much like reverting to a restore point: choose the image (usually by date and time) to which you’d like to roll back, then initiate the restore procedure. For example, Macrium Reflect offers a “Restore” menu, then allows you to browse stored backup files to pick the one you want in an Explorer-based Open window.

If reverting to a restore point or image backup doesn’t work (or you don’t have either of these), it’s time to move on to Step 3.