SFC Scannow: Complete Guide to Checking and Restoring Windows System Files

Introduction / Why It's Needed

SFC Scannow (System File Checker) is a Windows system utility designed to verify the integrity of protected system files. It automatically scans critical OS components such as drivers, DLL libraries, and the registry, replacing corrupted or missing versions with correct ones from the local cache. This process helps resolve a wide range of issues—from random application crashes to critical boot errors. Regularly using SFC Scannow can significantly improve your system's stability and performance, especially after virus attacks, failed updates, or manual interference with system files.

Requirements / Preparation

Before running SFC Scannow, ensure the following conditions are met:

• Administrator privileges: The command requires elevated rights. Make sure you are logged in with an administrator account.
• Stable power supply: If using a laptop, connect it to a power outlet to avoid interruption due to battery drain.
• Internet access (recommended): Although SFC uses a local cache, if necessary files are missing, it may need to connect to the Windows Update Center to download them.
• Close all applications: To minimize conflicts, close all running programs, especially those that may be using system files (e.g., antivirus software or file managers).

Step 1: Launch Command Prompt or PowerShell as Administrator

SFC Scannow is executed via Command Prompt (cmd) or Windows PowerShell. Both interfaces work the same way, but PowerShell provides more modern functionality. Here's how to launch them with administrator rights:

1. Press the Win + X key on your keyboard or right-click the Start button.
2. In the menu that appears, select one of the options:
   • Command Prompt (Admin) — for the classic interface.
   • Windows PowerShell (Admin) — for advanced capabilities.
   • In Windows 11, you may see Windows Terminal (Admin) — this is the modern replacement for PowerShell.
3. If a User Account Control (UAC) prompt appears, click Yes to confirm launching with elevated privileges.

💡 Tip: If you don't see items labeled "Admin," search for "Command Prompt" or "PowerShell" in the Start menu, right-click, and select "Run as administrator."

Step 2: Enter the SFC Scannow Command

After opening the Command Prompt or PowerShell window with administrator rights, perform the following actions:

1. Ensure the cursor is blinking in the window (this indicates readiness for input).
2. Type the command:

   sfc /scannow
   

   Or in classic Command Prompt:

   sfc /scannow
   

3. Press Enter to start.

The sfc /scannow command initiates an immediate scan of all protected system files. The utility will check every registry entry associated with system components and compare file hashes against reference values from the Windows cache (the C:\Windows\System32\catroot2 folder). If discrepancies are found, SFC will automatically attempt to replace corrupted files.

⚠️ Important: Do not use keys like /scanonce or /verify—full recovery requires exactly /scannow. The process may take time, especially on systems with many files or a slow disk.

Step 3: Wait for the Scan to Complete

After entering the command, the scan will begin. Progress is displayed on screen as a percentage and current stage:

• Initial stage: "Beginning system scan. This process may take several minutes."
• Main stage: Tracking files being checked. You may see messages like "Checking file filename."
• Completion: At the end, a final message will appear, such as:
  • "Windows Resource Protection did not find any integrity violations." — means all files are intact.
  • "Windows Resource Protection found and repaired corrupted files." — the issue is resolved.
  • "Windows Resource Protection found corrupted files but was unable to fix some of them." — additional action is needed (see the "Potential Issues" section).

What to do during the scan:

• Do not close the Command Prompt window.
• Do not restart the computer.
• Do not run other resource-intensive applications to speed up the process.
• If the process appears "stuck" on one percentage for more than 30 minutes, there may be a conflict with antivirus software—temporarily disable it (but only if you are confident in system safety).

Step 4: Analyze Results and Reboot

After SFC completes, it will display a final message. Actions depend on the outcome:

1. If files were repaired: Simply restart your computer for changes to take effect. To do this from the Command Prompt, type:

   shutdown /r /t 0
   

   
   Or use the Start menu → Restart.
2. If no violations were found: Your system is in good order. However, if problems (e.g., application crashes) persist, the cause may not be system files. Try other diagnostic methods, such as disk check (chkdsk) or clean boot.
3. If errors were not fixed: In this case, SFC will report that some files could not be repaired. This usually happens if the Windows image itself is corrupted or correct source files are missing from the cache. Proceed to the "Potential Issues" section for solutions.

💡 Tip: Scan details can be found in a log file. After completion, open File Explorer and navigate to C:\Windows\Logs\CBS\CBS.log. This is a text file with the full scan history. To quickly find errors, filter it by words like "cannot repair" or "failed".

Verifying the Result

To ensure SFC Scannow worked effectively, perform the following actions after rebooting:

1. Check system functionality: Launch previously problematic applications or features. Confirm that errors (e.g., "file not found" or "component missing") no longer appear.
2. Review Event Viewer: Open Event Viewer (Win + R → eventvwr.msc). Navigate to Windows Logs → Application and look for events with source Winlogon or SFC on the day of execution. Successful recovery is typically logged as an informational event.
3. Rerun SFC (optional): For complete certainty, run sfc /scannow again. If the result is the same ("no integrity violations"), the system is stable.
4. Monitor performance: Use Task Manager (Ctrl + Shift + Esc) to check for any unusual processes or high CPU usage that existed before recovery.

If after all steps the issue persists, it likely relates to hardware (e.g., a failing hard drive) or deep corruption of the Windows image—in which case more advanced methods like system restore or a clean Windows install will be required.

Potential Issues

Despite the simplicity of the command, common problems can arise when running SFC Scannow. Here's how to resolve them:

Issue 1: Error "Windows Resource Protection could not perform the requested operation"

Cause: Most often this occurs due to lack of administrator rights or blocking by antivirus/firewall. Sometimes the problem lies in a corrupted update cache.

Solution:

• Ensure you launched Command Prompt as administrator.
• Temporarily disable antivirus and firewall (e.g., Windows Defender) during the scan. Remember to re-enable them afterward.
• Clear the update cache: stop the Windows Update service (services.msc), delete files in C:\Windows\SoftwareDistribution\Download, then restart the service and retry SFC.

Issue 2: SFC Scannow does not repair files, reports "unable to fix some files"

Cause: The Windows image itself (WIM file) is corrupted, or correct source files are missing from the cache. This often happens after failed updates or system modifications.

Solution:

1. First, perform an image restore using DISM:

   DISM /Online /Cleanup-Image /RestoreHealth
   

   This command downloads corrected files from Microsoft servers (requires internet) and fixes the image.
2. After DISM completes successfully (message "The restore operation completed successfully"), rerun sfc /scannow.
3. If DISM also fails, consider System Restore to a point before the issue occurred, or a clean Windows install.

Issue 3: SFC Scannow takes too long (over 1 hour) or hangs

Cause: Large number of corrupted files, slow hard disk (HDD instead of SSD), or conflict with background processes.

Solution:

• Check disk health with chkdsk C: /f (requires reboot). A failing disk can slow file access.
• Run SFC in Safe Mode:
  1. Restart the computer by holding Shift while clicking Restart in the Start menu.
  2. Select "Troubleshoot" → "Advanced options" → "Startup Settings" → "Restart".
  3. After reboot, press F5 or 5 for "Safe Mode with Networking".
  4. Launch Command Prompt as administrator and run sfc /scannow.
• Increase the paging file size: open "System Properties" → "Advanced" tab → "Performance" settings → "Advanced" → "Change" in virtual memory. Set initial and maximum size equal to 1.5× your RAM.

Issue 4: Too many errors in CBS.log, but SFC reports success

Cause: SFC only repairs critical system files. Some minor corruption (e.g., in third-party drivers) may be ignored but still logged.

Solution:

• Analyze CBS.log: open the file in Notepad and search for lines containing "Cannot repair" or "Failed". If errors relate to third-party components (non-Microsoft), update or reinstall the corresponding software.
• Use the DISM tool for deeper image recovery, as described above.

Issue 5: The sfc /scannow command is not found or returns "access denied"

Cause: The SFC utility itself is corrupted, or system environment variables are damaged. Rarely, the System32 folder may be excluded from scanning.

Solution:

• Check for the presence of sfc.exe in C:\Windows\System32. If missing, restore it from a Windows installation medium.
• Run Windows image integrity check via DISM (see Issue 2).
• As a last resort, use System Restore or a Windows bootable media to run SFC in the recovery environment (WinRE). To do this:
  1. Create a Windows installation USB drive.
  2. Boot from it, select "Repair your computer" → "Troubleshoot" → "Command Prompt".
  3. Enter sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows (replace C:\ with your system drive letter).

These solutions cover most scenarios. If the problem persists, more serious intervention may be required, such as resetting Windows while keeping files or performing a clean install.