Get to know DISM.exe and SFC.exe before you run them

Posted on Aug 19, 2023

tl;dr: The good-to-know stuff about two complementary Windows command-line tools.

Updated 25 August 2023.

Introduction

I’m not a tech expert but a self-proclaimed do-it-yourself (DIY) tech nerd, and I like ensuring that my personal computers (PCs) function as they should and that I enjoy using them for a long time.

The event that started this article

So it’s no surprise that my tech nerd antennae shook when I opened my laptop, and it did a check disk (CHKDSK) task at startup.

A CHKDSK is a system tool in Windows that confirms the file system data or information in the PC’s operating system (OS) is maintained, not modified or deleted, and attempts to fix logical file system errors.

The unexpected CHKDSK was odd because it was the first time I saw my laptop do that task at a startup.

The event signified that there might be errors with my laptop’s OS.

Climbing down the tech rabbit hole

So I climbed down the rabbit hole and began my research adventure with CHKDSK, and because I was already maintaining my PCs every week or so with System File Checker (SFC.exe) and Deployment Image Servicing and Management (DISM.exe), I decided to research those as well.

I’ve been running SFC and DISM almost weekly for the past month, not knowing what I’m doing. 🙄

I needed to know more about how to run them.

I took notes and want to share what I learned with this article.

I’m a Windows 10 user, so much of the content in this article is related to the Windows 10 OS.

This article is about:

Brief information on Command Prompt (Admin)
SFC/scannow
DISM.exe with command options /Online, /Cleanup-Image, and /RestoreHealth, /CheckHealth, and /ScanHealth.

☝🏼

What is this article’s point

I’ve got two.

I like it when I can complete my computing tasks like writing this article or playing a video game on my PC while functioning as it should.

I’m not too fond of it when my PC suddenly crashes and ruins my activity’s flow.

The first point is that when my PC isn’t functioning as it should, some related event causes file corruption; I have all this information as my reference.

I prefer fixing things myself because I get to learn how, and my out-of-pocket costs might be less.

It’s a good DIY tech nerd who knows how to run SFC and DISM since both tools can effectively repair and service a PC’s essential files.

It’s a good thing, too, that Windows comes with utilities built in to run with Command Prompt (Admin).

What could cause corrupt protected system files?

I use my PCs daily, and the hardware wears out and gets dirty and scratched, and the OS’s protected files get some data corruption.

So there are lots of events and reasons that can cause corrupt protected system files, like:

Bad software like viruses, spyware, and trojans
Bloatware—usually unnecessary apps
Computer crashes
Damaged storage drives because the PC is dirty or operating a PC at high temperatures
Installing, reinstalling, and uninstalling apps
Junk files—leftover temporary files from a previous PC task that a PC doesn’t need
Malicious software (malware)
Not safely removing storage devices from the PC
Not saving files properly
Not using surge protectors that can safeguard against power surges
Software update errors
Sudden power outages

So the second point is you might be a do-it-yourself person who uses your favorite PC daily, and you like to regularly maintain your PC(s) and figure out and solve tech issues yourself.

Suppose you’re the type of person who likes to get to the point of things and needs immediate answers to your questions. Feel free to save this article to your browser’s reading list. 😁

Before we get into the cool stuff about both Windows command-line tools, let’s say Hi 👋🏼 to Command Prompt (Admin).

☝🏼

Illustration of Command Prompt Admin window

I used my photo of my lappy’s command prompt admin window as a reference to illustrate the above image. TY Microsoft! 🙏🏼😁

☝🏼

Command Prompt (Admin)

You’ll need Command Prompt (Admin) to run SFC /scannow and DISM.exe.

Command Prompt (Admin) is Command Prompt Administrator.

Microsoft Support supplies a straightforward explanation of what an administrator can do on a computer. Borrowing the support article’s description, I converted it into the below list for easy reading.

An administrator can do the following:

Make changes on a computer that affect users of the computer
Change security settings
Install software and hardware
Access all files on the computer
Change user accounts

For more information about Command Prompt (Admin) and how to run this, please read my article How to Run Command Prompt Admin.

☝🏼

What is SFC

SFC is System File Checker (sfc.exe), a Windows core system file in C:\Windows\System32.

The .exe file name extension is an executable file with encoded instructions that tell the PC to do an indicated task.

It’s a Windows command-line utility, a tool in Windows that scans and restores corrupt system files.

The System File Checker is part of the Windows Resource Protection (WRP).

WRP is like the bodyguard at the door of the PC’s essential OS directory that holds necessary system files, folders, and registry keys that hold off replacing those OS contents.

When SFC detects changes to a protected file, that file becomes restored from a cached copy in the Windows directory.

Only Microsoft Windows updates can change the OS files, which can help prevent application and OS failures.

Third-party apps/software mustn’t alter WRP-protected OS files because Windows and its apps use these.

If a third party changes a WRP-protected OS file, the PC’s protected system files become corrupted, and the PC stops functioning as it should.

As an administrator (Admin) of your PC, you can scan all its protected files to verify their versions.

And only as an Admin can you run SFC.

How does SFC work

When SFC finds an overwritten protected file, the following happens:

The SFC gets the correct version of a protected file from the system’s cache folder in the System32 folder in the SystemRoot folder and replaces the incorrect protected file.

The file path is %Systemroot%\System32\Dllcache.

%Systemroot% (Systemroot) is the directory, also known as the folder (stores files and other directories), where the Microsoft OS is installed (C:\Windows).

System32 is a core folder with the OS files needed for your PC’s smooth functioning. In this folder are drivers, DLL files, and EXE files.

Though Windows 10 OS is 64-bit, System32 is the folder’s kept name because many apps look for the 64-bit binaries in this folder.

Dllcache is the Dynamic Link Library cache (stores data that the system frequently accesses).

The DLL is a collection of small systems files that more extensive programs load to complete tasks.

The DLL file holds instructions that assist more extensive programs in handling functions that might not be a part of the original program.

The SFC can also get the correct version of a protected file from the Windows installation source file to replace the incorrect protected file.

SFC also checks and repopulates the cache folder.

What is the /scannow command

The /scannow is part of the SFC /scannow syntax that repairs the cache folder contents.

The /scannow command scans the system’s protected files and replaces the overwritten or corrupt files with a cached copy from the dllcache folder.

What exactly is SFC /scannow

SFC /scannow will scan all protected system files and replace corrupted files with a cached copy from a compressed folder at %WinDir%\System32\dllcache.

The %WinDir% placeholder represents the Windows OS folder—for example, C:\Windows.

The /scannow command-line option immediately scans all protected system files, replaces the incorrect versions with correct Microsoft versions, and might access the Windows installation source files.

SFC /scannow doesn’t require internet access.

Does SFC /scannow improve performance?

Yes, it improves your PC’s Windows performance since it repairs all corrupted system files.

What is the proper syntax for SFC /scannow

I learned that Windows Command Prompt is case insensitive, so any of the syntaxes below are accepted:

SFC /scannow
sfc /scannow—I like inputting this in lowercase; it’s easier. 😸
sfc /SCANNOW
sfc /Scannow

☝🏼

How to run SFC /scannow

The main steps are:

A. Run Windows update
B. Run DISM.exe
C. Run SFC

The details are as follows:

Go to Windows Update and check for the latest Windows updates.

a. Select the Start button, and then go to Settings > Update & Security > Windows Update.
b. Restart the PC, if needed.
Right-click the Windows Start icon, on the power user menu click Command Prompt (Admin), and click Yes on the User Account Control (UAC) window.
In the command prompt interface window, input DISM.exe /Online /Cleanup-Image /RestoreHealth (there must be a space before each forward-slash ( / )), then press Enter. The time length in this step might vary from a few minutes or longer to start and complete, so a coffee refill or a glance out to nature might be a nice break. ☕🌴
After a message The operation completed successfully displays, type sfc /scannow (there must be a space between sfc and the forward-slash ( / )) and press Enter.
After the message Verification 100% complete displays, type exit and press Enter.

After completing the above steps, the output below depicts DISM.exe’s completed operation, and WRP doesn’t find any integrity violations.

   Microsoft Windows [Version 10.0.19045.3324]
   (c) Microsoft Corporation. All rights reserved.

   C:\WINDOWS\system32>DISM.exe /Online /Cleanup-Image /RestoreHealth

   Deployment Image Servicing and Management tool
   Version: 10.0.19041.844

   Image Version: 10.0.19045.3324

   [==========================100.0%==========================] The restore operation completed successfully.
   The operation completed successfully.

   C:\WINDOWS\system32>sfc /scannow

   Beginning system scan. This process will take some time.

   Beginning verification phase of system scan.
   Verification 100% complete.

   Windows Resource Protection did not find any integrity violations.

   C:\WINDOWS\system32>exit

Below is a sample output from running sfc /scannow, where WRP found and repaired corrupt files.

   C:\WINDOWS\system32>SFC /Scannow

   Beginning system scan. This process will take some time.

   Beginning verification phase of system scan.
   Verification 100% complete.

   Windows Resource Protection found corrupt files and successfully repaired them.
   For online repairs, details are included in the CBS log file located at
   windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
   repairs, details are included in the log file provided by the /OFFLOGFILE flag.

☝🏼

What is DISM.exe

DISM is Deployment Image Servicing and Management, a command-line tool that can repair and service Windows system image files.

DISM can restore damaged or corrupt Windows files by downloading a fresh copy from the internet.

DISM.exe, an executable file, is in the C:\Windows\system32 folder.

And only as an Admin can you run DISM.exe.

In step 3 of the above SFC how-to, we used the input DISM.exe /Online /Cleanup-Image /RestoreHealth.

Below are clarifications to the command-line options /Online, /Cleanup-Image, and /RestoreHealth.

What is /Online

With the /Online option, DISM will repair and service the PC on which the user runs this command option.

This option causes automatic detection of the Windows directory for the online image.

The /Online option means that DISM will download files from Windows Update to replace the corrupt file, but if the user doesn’t connect the PC to the internet, DISM might fail to repair and service Windows system image files.

When we start and sign in to our PC on Windows 10, its OS image is online.

When we run DISM to repair or service the OS image files, we use the /Online option of the DISM command.

What is /Cleanup-Image

This command-line option does a broad cleanup and gets back the OS’s image files.

So running the command DISM.exe /Online /Cleanup-Image means that on your running Windows OS, DISM is doing a broad cleanup and getting back the system’s image files.

What is /RestoreHealth

This command-line option surveys the Windows OS for corrupt image files and tries to repair those files automatically.

Additional DISM command-line options

In place of /RestoreHealth I sometimes use:

/CheckHealth—This checks for corrupted local Windows OS image files and if the corrupted image files can be repaired.
/ScanHealth—This scans the Windows OS image files for component store problems.

The command-line syntax for the above command options are:

DISM.exe /Online /Cleanup-Image /CheckHealth and
DISM.exe /Online /Cleanup-Image /ScanHealth.

Proper DISM syntax

Since Windows Command Prompt is case insensitive, the acceptable DISM.exe command-line syntax is:

DISM.exe /Online /Cleanup-Image /RestoreHealth or
DISM.exe /Online /Cleanup-image /Restorehealth

☝🏼

DISM.exe how-to

Tech experts recommend running the DISM command tool options in this order: 1 - /CheckHealth, 2 - /ScanHealth, and 3 - /RestoreHealth.

Other experts recommend that running /CheckHealth and or /ScanHealth before running /RestoreHealth isn’t necessary.

I usually follow the latter recommendation.

Run /CheckHealth how-to

Right-click the Start icon on the taskbar.
On the menu, click Command Prompt (Admin).
Input DISM.exe /Online /Cleanup-Image /CheckHealth and press Enter.
DISM.exe will run and check for corrupted local Windows OS image files and if the corrupted image files can be repaired.

The output below depicts no component store corruption detected.

   Microsoft Windows [Version 10.0.19045.3324]
   (c) Microsoft Corporation. All rights reserved.

   C:\WINDOWS\system32>DISM.exe /Online /Cleanup-Image /CheckHealth

   Deployment Image Servicing and Management tool
   Version: 10.0.19041.844

   Image Version: 10.0.19045.3324

   No component store corruption detected.
   The operation completed successfully.

Run /ScanHealth how-to

Right-click the Start icon on the taskbar.
On the menu, click Command Prompt (Admin).
Input DISM.exe /Online /Cleanup-Image /ScanHealth and press Enter.
DISM.exe will scan the Windows OS image files for component store problems.

The output below depicts no component store corruption detected.

   C:\WINDOWS\system32>DISM.exe /Online /Cleanup-Image /ScanHealth

   Deployment Image Servicing and Management tool
   Version: 10.0.19041.844

   Image Version: 10.0.19045.3324

   [==========================100.0%==========================] No component store corruption detected.
   The operation completed successfully.

Run /RestoreHealth how-to

Right-click the Start icon on the taskbar.
On the menu, click Command Prompt (Admin).
Input DISM.exe /Online /Cleanup-Image /RestoreHealth and press Enter.
DISM.exe will connect to Windows Update online to download and replace corrupted image files.

☝🏼

What is the order sequence to run DISM and SFC

Microsoft support recommends that if your PC is on the Windows 10 OS, run DISM.exe first, then run SFC /scannow.

That recommendation makes sense.

Let’s clarify

SFC /scannow pulls sources from the Windows Component Store.

DISM fixes the system file source cache in the WinSxS folder.

What is WinSxS

WinSxS is Windows Side by Side.

A WinSxS folder is the component store of Windows OS. So, the Windows 10 OS stores its core components in the WinSxS directory.

The WinSxS folder is the only location where the OS components are stored.

The Windows component store is in C:\Windows\WinSxS.

The component store supports functions required for Windows’s customization and updating.

This folder holds DLL, EXE, and system files.

Important! We must never delete files from the WinSxS folder or the WinSxS folder itself. Our precious PC might not update or boot!

The Windows OS automatically reduces the WinSxS folder’s size through Windows Updates by uninstalling, deleting, and replacing components with newer versions.

Windows keeps older versions of components until its OS auto-deletes them in case the user wants to roll back a previous update.

Run DISM.exe first

SFC /scannow pulls the source from the WinSxS to repair/restore system files.

If the system file source cache is corrupted and not repaired with DISM, running SFC /scannow first will have SFC pulling files from a corrupted WinSxS folder to fix problems.

Therefore, run DISM first, then run SFC. 🤓

Running DISM.exe first ensures that the system files in the WinSxS folder are good to go and accounted for 100% so that running SFC /scannow can use those uncorrupted and accounted-for files to fix the protected corrupt files.

☝🏼

Include DISM and SFC in the PC’s maintenance schedule

I called tech support and told them my computer was frozen.
They said to hold the power button, and I was like
“Um, it’s covered with ice, man.”

― CoolFunnyQuotes.com

PCs are expensive and very useful for stuff we enjoy doing, like googling, reading information on Wikipedia, writing for our website, watching YouTube videos, movies, and TV shows, and playing video games.

We want to ensure our devices function as they should and last longer than expected.

We can help our precious Windows PCs by regularly maintaining their OS.

We must discipline ourselves to perform daily, weekly, or monthly maintenance tasks.

Below are what I do:

Back up essential files.
Run Disk Cleanup and Total PC Cleaner.
Run CHKDSK.
Run DISM.exe.
Run SFC /scannow.
Run Window Update.
Set up the PC for scheduled virus and malware scans.
Run manual virus and malware scans.
Use only Microsoft apps and software to clean and update your PC.
Keep your PCs clean inside and out.

☝🏼

Conclusion

I learned so much from researching and writing this article. My tech toolbox has gotten heavier with this helpful information. 😃

The Microsoft built-in System File Checker (SFC) and Deployment Image Servicing and Management (DISM) are command-line tools that help us troubleshoot and repair issues with our PC’s Windows OS files.

SFC scans and repairs corrupted system files on a Windows system, and DISM repairs and services the Windows image files.

Running these command tools during our regular PC maintenance schedule can help our precious PC’s Windows system function as it should.

☝🏼