How to Run an SFC Scan in Windows 11

To run an SFC scan in Windows 11, open Start, type Command Prompt, right-click it and choose Run as administrator. Run DISM.exe /Online /Cleanup-image /Restorehealth first, then type sfc /scannow, press Enter and leave the window open until verification reaches 100%.

Applies to: Windows 11 (the same commands are documented for Windows 10). Checked against Microsoft Support on October 7, 2026.

What an SFC scan does

SFC stands for System File Checker. It is a command-line tool built into Windows that checks the integrity of all protected system files and replaces damaged or incorrect versions with a correct cached copy. Microsoft suggests it when Windows features stop working properly, when you see system errors, or when Windows freezes or becomes unresponsive.

SFC only deals with protected Windows system files. It is not a tool for repairing a damaged document, photo or app, and it cannot fix problems caused by failing hardware or a faulty driver.

Before you start

• Use an administrator account. Microsoft’s command reference says you must be signed in as a member of the Administrators group to run SFC.
• Stay connected to the internet for the first command. DISM uses Windows Update as the source for any files it needs.
• Save your work. Each command can take several minutes, and you may need to restart afterward.

Run an SFC scan in Windows 11

Microsoft’s current instructions use two commands in order. The first one, DISM (Deployment Image Servicing and Management), repairs the Windows image that SFC draws its replacement files from. The second one is the SFC scan itself.

1. Select Start and type Command Prompt (typing cmd also works). Command Prompt appears in the search results.
2. Right-click Command Prompt and select Run as administrator. If Windows asks for an administrator password or for confirmation, type the password or select Yes. A Command Prompt window opens with administrator rights.
3. Type DISM.exe /Online /Cleanup-image /Restorehealth and press Enter. Note the space before each forward slash. Microsoft says this operation may take several minutes, so wait until the prompt returns.
4. Type sfc /scannow and press Enter. There is one space between sfc and the slash. The scan starts and shows its progress as a percentage.
5. Do not close the Command Prompt window until verification is 100% complete. When it finishes, SFC prints one of four result messages, explained below.
6. If SFC reports that it repaired files, restart the PC and check whether the original problem is gone.

Another way to open an administrator window

You can run the same two commands in Windows Terminal. Microsoft’s Windows Terminal documentation gives this route: press the Windows key + X and select Windows Terminal (Admin). The entry may be worded slightly differently on your PC, but it is the one marked as Admin. Then follow steps 3 to 6 above.

What the SFC results mean

Microsoft lists four possible messages at the end of the scan.

Message	What it means	What to do next
Windows Resource Protection did not find any integrity violations.	No protected system files are missing or corrupted.	Nothing to repair. Look for another cause of the problem.
Windows Resource Protection could not perform the requested operation.	The scan could not run.	Run the scan again in safe mode.
Windows Resource Protection found corrupt files and successfully repaired them.	The damaged files were replaced.	Restart and test. The details are in the CBS log.
Windows Resource Protection found corrupt files but was unable to fix some of them.	Some files are still damaged.	Read the log to see which files, then repair them manually or use a Windows recovery option.

How to read the SFC log

SFC writes its details to a shared log file at %windir%\Logs\CBS\CBS.log, where %windir% is the Windows folder, typically C:\Windows. That file contains much more than SFC entries, so Microsoft provides a command that copies only the SFC lines into a text file on your desktop.

1. Open Command Prompt as an administrator, as in the main steps.
2. Type the following command and press Enter: findstr /c:”[SR]” %windir%\Logs\CBS\CBS.log >”%userprofile%\Desktop\sfcdetails.txt”
3. Open the sfcdetails.txt file that appears on your desktop. Each line starts with a date and time.

The file includes entries from every time SFC has run on the PC, not only the latest scan. Check the date and time on each line so that you are reading the entries from the scan you just ran.

If SFC could not repair some files

Work through these options in order, from least to most disruptive.

1. Run both commands again. If the DISM command did not finish successfully the first time, SFC may not have had good copies to restore from. Make sure the PC is online, run the DISM command, then run sfc /scannow again.
2. Check the Windows image. Microsoft documents two DISM checks: Dism /Online /Cleanup-Image /ScanHealth scans the image for corruption, and Dism /Online /Cleanup-Image /CheckHealth reports whether the image is healthy, repairable or non-repairable.
3. Replace a single file manually. Microsoft describes an advanced procedure: find the damaged file in sfcdetails.txt, get a known good copy from another computer running the same version of Windows, take ownership with takeown /f, grant administrators access with icacls, and then copy the good file over the damaged one. This is easy to get wrong, so follow Microsoft’s System File Checker instructions exactly if you try it.
4. Use a Windows recovery option. If the steps above do not help, Microsoft points to its recovery options. Reset includes a Keep my files choice that keeps personal files such as documents and pictures but removes apps and settings, so back up first.

Do not download replacement system files from file-sharing or DLL download sites. A copy from an unknown source may be the wrong version or unsafe.

Troubleshooting

SFC says it could not perform the requested operation

Microsoft’s fix is to start the PC in safe mode and run the scan again. Our guide on how to get into safe mode in Windows 11 covers the restart steps. Microsoft also says to make sure the PendingDeletes and PendingRenames folders exist under %WinDir%\WinSxS\Temp.

SFC will not start, or says you need to be an administrator

The window was opened without administrator rights. Close it, then open Command Prompt again with Run as administrator. If your account is a standard account on a home PC, see how to get permission from an administrator in Windows 11. On a work or school PC your account may not be an administrator at all. In that case, ask your IT department to run the scan.

The DISM command fails or cannot find source files

DISM downloads repair files through Windows Update, so check your internet connection and try again. If Windows Update itself is broken, Microsoft documents an alternative that points DISM at a working Windows installation or other repair source: DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:C:\RepairSource\Windows /LimitAccess, where you replace C:\RepairSource\Windows with the location of your repair source. The /LimitAccess part stops DISM from using Windows Update.

Windows will not start at all

SFC can also scan a Windows installation that is not running. This is done from a Command Prompt in the Windows Recovery Environment (Windows RE), which Microsoft says starts automatically after two consecutive failed attempts to start Windows. You can also reach it by holding Shift while you select Restart on the sign-in screen, or by starting the PC from recovery media.

The command Microsoft gives for an offline scan is SFC /Scannow /OffBootDir=C:\ /OffWinDir=C:\Windows. The drive letter for Windows is not always C: inside the recovery environment (Microsoft’s command reference shows an example that uses D:), so confirm which drive holds the Windows folder before you run it. If you suspect the drive itself is damaged, Microsoft’s startup troubleshooting guide also lists chkdsk /f /r to check for and repair disk corruption.

Other SFC commands

Microsoft’s sfc command reference lists these options for Windows 11.

Command	What it does
sfc /scannow	Scans all protected system files and repairs files with problems when possible.
sfc /verifyonly	Scans all protected system files without making repairs.
sfc /scanfile=<file>	Scans one file, given as a full path and file name, and tries to repair it.
sfc /verifyfile=<file>	Checks one file without repairing it.
/offbootdir and /offwindir	Point SFC at an offline boot directory and Windows directory for offline repair.

For example, Microsoft’s reference uses sfc /verifyfile=c:\windows\system32\kernel32.dll to check a single file. Use /verifyonly when you want to know whether anything is wrong before you let Windows change files.

Frequently asked questions

Should I run DISM or SFC first?

Run DISM first. Microsoft’s instructions list the DISM command as step 1 and sfc /scannow as step 2, because SFC replaces damaged files from a stored copy that DISM repairs.

How long does an SFC scan take?

Microsoft says only that each command may take several minutes. The time depends on the PC, so wait for the 100% message instead of assuming the scan has stalled.

Does an SFC scan delete my personal files?

SFC checks and replaces protected Windows system files. Microsoft’s documentation does not describe it changing documents, pictures or other personal files.

Can I run SFC in Windows Terminal instead of Command Prompt?

Yes, as long as the Terminal window was opened as an administrator. The sfc /scannow command is the same.

What happened to sfc /scanonce, /scanboot and /purgecache?

Those switches appear in Microsoft’s older Windows File Protection documentation, but they are not in the current sfc command reference for Windows 11. Use the options in the table above.

Where is the SFC log file?

It is part of %windir%\Logs\CBS\CBS.log. Use the findstr command in the log section above to pull the SFC lines into a readable text file.

If the scan comes back clean but the problem continues, the cause is probably not a system file. Our guide on fixing corrupted files in Windows 11 is a good next step.