Windows SFC Cannot Repair Corrupted System Files

Jane Smith 0 Reputation points
2026-11-03T16:16:39.5366667+00:00

System File Checker repeatedly reports that some corrupted system files cannot be repaired. How can I correlate CBS.log entries with component store health and determine whether an offline repair is necessary?

Windows for business | Windows 365 Enterprise
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hoang Le Huy 1,840 Reputation points Independent Advisor
    2026-11-03T16:53:02.9133333+00:00

    Hello Jane Smith,

    When SFC repeatedly fails to repair corrupted files, the first thing I'd recommend is checking whether the problem comes from individual system files or the Windows component store (WinSxS). Open Command Prompt as Administrator and run findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\SFCDetails.txt" to extract the relevant entries and identify which files cannot be repaired. Then run DISM /Online /Cleanup-Image /CheckHealth and DISM /Online /Cleanup-Image /ScanHealth to check the component store. If corruption is detected, try DISM /Online /Cleanup-Image /RestoreHealth, then run sfc /scannow again. If DISM also fails, check %windir%\Logs\DISM\dism.log and consider using matching Windows installation media as a repair source; offline repair should only be necessary if online repair is unsuccessful or the Windows installation cannot boot properly.

    You can refer to Microsoft's official guidance: Repair a Windows Image and DISM Command-Line Options.

    If my answer is useful for you, please hit Accept the answer for me please.

    HL.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-03T16:17:01.1666667+00:00

    Use this sequence to correlate SFC results with component store health and decide whether offline repair is needed:

    1. Run DISM before rerunning SFC. Open an elevated Command Prompt and run: 
         DISM.exe /Online /Cleanup-image /Restorehealth
      DISM provides the files needed to repair corrupted files. If Windows Update cannot provide the source files, run DISM with a repair source instead: 
         DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:C:\RepairSource\Windows /LimitAccess
      Replace C:\RepairSource\Windows with the actual repair source path.
    2. Run SFC again. 
         sfc /scannow
      Do not close the Command Prompt window until verification reaches 100%.
    3. Interpret the SFC result message.
      • Windows Resource Protection did not find any integrity violations.: no missing or corrupted protected system files were found.
      • Windows Resource Protection found corrupt files and successfully repaired them.: repair succeeded.
      • Windows Resource Protection found corrupt files but was unable to fix some of them.: inspect CBS.log to identify what could not be repaired.
      • Windows Resource Protection could not perform the requested operation.: run SFC in Safe Mode and verify that %WinDir%\WinSxS\Temp\PendingDeletes and %WinDir%\WinSxS\Temp\PendingRenames exist.
    4. Extract only SFC-related entries from CBS.log. CBS.log also contains entries from the Windows Modules Installer service, so filter on [SR]: 
         findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt
      Review sfcdetails.txt instead of the full log when correlating SFC activity.
    5. Correlate the log entries with repairability. In the filtered log:
      • Cannot repair member file ... means the file content does not match the operating system definition and SFC could not repair it.
      • Repaired file ... by copying from backup means SFC repaired the file from a private system store backup.
      • Repairing corrupted file ... from store means SFC repaired the file from the system store.
    6. Correlate SFC findings with component store health. Component store corruption is indicated when:
      • sfc /scannow reports files it cannot repair.
      • DISM /CheckHealth or /ScanHealth reports corruption.
      • CBS.log contains corruption entries such as STATUS_SXS_COMPONENT_STORE_CORRUPT or HRESULT 0x80073712. Common corruption-related update errors also include 0x800F0831, 0x80073701, and 0x800F081F.
    7. Decide whether offline repair is necessary. Offline repair is indicated when online repair cannot obtain source files or when an offline Windows installation must be repaired. The supported SFC offline syntax is: 
         sfc /scanfile=D:\windows\system32\kernel32.dll /offbootdir=D:\ /offwindir=D:\windows
      SFC also supports /offlogfile=<log file path> for offline repair logging.
    8. Avoid false positives from CBS.log. Some CBS.log entries can report files as not repaired even when no actual repair is required. Microsoft documents cases where static files that are not protected by Windows Resource Protection are logged as changed. In that case, the log can show Cannot repair member file ... even though the SFC transaction reports successful repair.

    Practical decision point:

    • If SFC cannot repair files, run DISM.exe /Online /Cleanup-image /Restorehealth, then rerun sfc /scannow.
    • If DISM or CBS.log shows component store corruption, treat the issue as component store health related.
    • If DISM cannot access repair sources, use a repair source with /Source and /LimitAccess.
    • If the target Windows installation is offline, use SFC offline parameters.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.