17

What is the purpose of the DISM /RestoreHealth parameter and the SFC /ScanNow parameter?

  • How do they correlate to one another?
  • In what order should they be run?
  • Why does the order sequence matter when executing either?
JW0914
  • 9,096

1 Answers1

24

The Component Store [%WinDir%\WinSxS] maintains a backup copy of all Windows system files, and SFC [System File Checker] & DISM [Deployment Image Servicing and Management] manage two separate, vital pieces of the Component Store and OS, with SFC relying entirely upon what DISM manages:

  • DISM has two functions SFC relies upon, /StartComponentCleanup and /RestoreHealth, with /RestoreHealth relying solely upon /StartComponentCleanup
    • /StartComponentCleanup: Cleans the Component Store of any broken hard links
      (It's imperative folks on Insider Builds run this regularly due to the frequent updates)
    • /RestoreHealth: Verifies and fixes any corruption in the Component Store by verifying it's system file backups against known good copies from the Windows Update servers through hash comparison; while an offline method does exist [below], it may not always fix the corruption
      • Windows 7: SUR [System Update Readiness] tool is used in lieu of this, as DISM didn't have this functionality until Windows 8, with SUR operating differently than DISM

  • SFC always assumes the Component Store is not corrupted and is why the DISM /RestoreHealth parameter should always be run prior to SFC; not doing so allows a corrupted Component Store to potentially replace a good system file with a corrupted one or fail to fix corruption within %WinDir% altogether
    • /ScanNow: Verifies and fixes any corruption within %WinDir% by verifying against the known good copies within the Component Store through hash comparison

SFC and DISM will not resolve hardware related issues, as they only resolve OS system file corruption, excluding Registry hives, non-OS bundled drivers, and user config files within:

%WinDir%\System32\drivers\etc


DISM and SFC must be executed in the order listed:
(Each is hierarchical, relying upon what the preceding does | Windows 7: skip to #3)

  1. WinKey+R → Open: powershell → Ctrl+Shift+OK 
    # Windows ≥8:
  # Online [booted Windows image]:
    Dism /Online /Cleanup-Image /StartComponentCleanup

    Offline [non-booted Windows image]:
    

    Dism /Image:"Z:\Windows" /Cleanup-Image /StartComponentCleanup
    Cmdlet: 
    # Online:
  Repair-WindowsImage -Online -StartComponentCleanup

# Offline:
  Repair-WindowsImage -Path "Z:\Windows" -StartComponentCleanup

    The Component Store should always be cleaned prior to running Windows Update, after an issue with Windows Update, and at least once a month, as it becomes dirty over time from updates occasionally breaking hard links. 

  2. # Windows ≥8:
  # Online [booted Windows image]:
    Dism /Online /Cleanup-Image /RestoreHealth

    Offline [non-booted Windows image]:
    

    Dism /Image:"Z:\Windows" /Cleanup-Image /RestoreHealth
    Cmdlet: 
    # Online:
  Repair-WindowsImage -Online -RestoreHealth

# Offline:
  Repair-WindowsImage -Path "Z:\Windows" -RestoreHealth

    Requires an internet connection, else the offline method will be required:

    • Use the install.<esd|wim> from the Windows Install ISO for the installed version:
      1. Create Windows <#> installation media → Download tool now → install on another PC
      2. Mount ISO to determine installed OS index [image] from its install.<esd|wim>: 
        Dism /Get-ImageInfo /ImageFile:"Y:\sources\install.<esd|wim>"
        Cmdlet: 
        Get-WindowsImage -ImagePath "Y:\sources\install.<esd|wim>"
      3. Specify index number at the end of the /Source parameter: 
        # Online [booted Windows image]:
 # ESD:
   Dism /Online /Cleanup-Image /RestoreHealth /Source:esd:"Y:\sources\install.esd":6 /LimitAccess

        WIM:
        

        Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:"Y:\sources\install.wim":6 /LimitAccess
        

        Offline [non-booted Windows image]:
        

        Dism /Image:"Z:\Windows" /Cleanup-Image /RestoreHealth /Source:esd:"Y:\sources\install.esd":6 /LimitAccess
        Cmdlet: 
        # Requires mounting ESD/WIM first:

  # Determine a partition to mount on:
    Gdr -PSProvider 'FileSystem'

  # Create Mount directory:
    Mkdir "C:\Mount\Windows"

  # If ESD, export to WIM first, as ESDs can't be mounted:
    MkDir "C:\sources"; Export-WindowsImage -SourceImagePath "Y:\sources\install.esd" -SourceIndex 6 -DestinationImagePath "C:\sources\install.wim" -CheckIntegrity -Compression Fast

  # Mount WIM:
    # Exported:
      Mount-WindowsImage -ImagePath "C:\sources\install.wim" -Index 1 -Path "C:\Mount" -ReadOnly

    # ISO:
      Mount-WindowsImage -ImagePath "Y:\sources\install.wim" -Index 6 -Path "C:\Mount" -ReadOnly

  # Either Source can be used: Mount\Windows || Mount\Windows\WinSxS
    Repair-WindowsImage -Image "Z:\Windows" -RestoreHealth -Source "C:\Mount\Windows"

  3. Windows 7: Run the SUR tool
  4. Reboot; if errors are found, review %WinDir%\Logs\DISM\dism.log from the bottom up
    (Log files are easier to read and sift through via the Log syntax in VS Code)
    • Windows ≥8: %WinDir%\Logs\DISM\dism.log
    • Windows 7: %WinDir%\Logs\CBS\CheckSUR.log
      (How to fix SUR errors) 

  5. # Online [booted Windows image]:
  Sfc /ScanNow

    Offline [non-booted Windows image / booted to WinPE/WinRE]:
    

    Sfc /ScanNow /OffBootDir=Z:\ /OffWinDir=Z:\Windows
    

    C: is usually not the drive letter in WinPE/WinRE
    

    To ascertain: DiskPart → lis vol → exit

  6. Reboot; if errors are found, output to %UserProfile%\Desktop\SFCdetails.log and review: 
    # Cmd:
  FindStr /c:"[SR]" "%WinDir%\Logs\CBS\CBS.log" > "%UserProfile%\Desktop\SFCdetails.log"

    PowerShell:
    

    FindStr /c:"[SR]" "$env:WinDir\Logs\CBS\CBS.log" > "$env:UserProfile\Desktop\SFCdetails.log"


I run these weekly via Task Scheduler to help prevent random issues from occurring:

  1. Dism_ComponentCleanup.xml
    Executes weekly on Sundays at 11:30:00
  2. Dism_RestoreHealth.xml
    Executes weekly on Sundays at 12:00:00
  3. Sfc_ScanNow.xml
    Executes weekly on Sundays at 13:00:00

Import into Task Scheduler:

  • GUI:
    1. WinKey+R → Open: TaskSchd.msc
    2. Action → New Folder... → Name: Custom
    3. Action → Import Task... → <task_name>.xml

  • CLI:
    • Cmd: 
      SchTasks /Create /Xml "%UserProfile%\Downloads\<task_name>.xml" /Tn "\Custom\Task Name" /Ru "%ComputerName%\%UserName%"
    • Powershell: 
      Register-ScheduledTask -Xml (Get-Content '$env:UserProfile\Downloads\<task_name>.xml' | Out-String) -TaskName "Task Name" -TaskPath "\Custom\" -User $env:ComputerName\$env:UserName –Force
JW0914
  • 9,096