Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Wednesday, July 24, 2019 2:32 PM | 1 vote
My wife's Windows 10 computer failed a couple of days ago. Wouldn't boot, just went into the dreaded "Preparing Automatic Repair / Diagnosing your PC" loop. But never actually repaired anything. After booting and rebooting for a few hours, in despair, I had no choice but to reinstall Windows 10, using a repair CD which I'd created when we first set up the PC.
Windows 10 is now working again, but sfc /scannow is reporting as follows:
"Windows Resource Protection found corrupt files but was unable to fix some of them. For online repairs, details are included in the CBS log file located at windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline repairs, details are included in the log file provided by the /OFFLOGFILE flag."
Looking at the above CBS.log file, there are numerous lines of gobbledygook such as:
"2019-07-24 14:56:51, Info CSI 0000033c Hashes for file member [l:23]'MSFT_MpPreference.cdxml' do not match.
** Expected: {l:32 ml:33 b:8861d55dd84b45902d2fbd8f73fd663be669f589105ce656000b77496ece0de6}.**
** Actual: {l:32 b:22454077de87f1cb3bff79e0acf51befbf929c31231f8c780fb9f254825f97ad}.**
2019-07-24 14:56:51, Info CSI 0000033d [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpPreference.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info CSI 0000033e Hashes for file member [l:17]'MSFT_MpScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:a27630566684ee79af41ac68dc70bbdbffc968b2489aa16be0d0fa0e0eccf0c8}.**
** Actual: {l:32 b:905248df4310b3bfe79b60dfe69b82517b81c16864e2e12677c50f6a66ca0459}.**
2019-07-24 14:56:51, Info CSI 0000033f Hashes for file member [l:17]'MSFT_MpScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:a27630566684ee79af41ac68dc70bbdbffc968b2489aa16be0d0fa0e0eccf0c8}.**
** Actual: {l:32 b:905248df4310b3bfe79b60dfe69b82517b81c16864e2e12677c50f6a66ca0459}.**
2019-07-24 14:56:51, Info CSI 00000340 [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpScan.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info CSI 00000341 Hashes for file member [l:20]'MSFT_MpWDOScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:80ddeca09c6c85cde406bd9352c24cb6ca58ab17062159713f0591c46fa7b9fd}.**
** Actual: {l:32 b:12f7403a57636e10490a52a2caf3010c56e0a86da83fda2c055e9534293039fb}.**
2019-07-24 14:56:51, Info CSI 00000342 Hashes for file member [l:20]'MSFT_MpWDOScan.cdxml' do not match.
** Expected: {l:32 ml:33 b:80ddeca09c6c85cde406bd9352c24cb6ca58ab17062159713f0591c46fa7b9fd}.**
** Actual: {l:32 b:12f7403a57636e10490a52a2caf3010c56e0a86da83fda2c055e9534293039fb}.**
2019-07-24 14:56:51, Info CSI 00000343 [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpWDOScan.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info CSI 00000344 Hashes for file member [l:22]'MSFT_MpSignature.cdxml' do not match.
** Expected: {l:32 ml:33 b:dbb84a0489a5dfeecb4e850412aabb72e725e5f89319d9e158a8baa9be6470da}.**
** Actual: {l:32 b:b4035789fec4e2e1ee3dd5e97a50a0cf5837308773d9ac1af3550f2ea04e9385}.**
2019-07-24 14:56:51, Info CSI 00000345 Hashes for file member [l:22]'MSFT_MpSignature.cdxml' do not match.
** Expected: {l:32 ml:33 b:dbb84a0489a5dfeecb4e850412aabb72e725e5f89319d9e158a8baa9be6470da}.**
** Actual: {l:32 b:b4035789fec4e2e1ee3dd5e97a50a0cf5837308773d9ac1af3550f2ea04e9385}.**
2019-07-24 14:56:51, Info CSI 00000346 [SR] Could not reproject corrupted file \?\C:\WINDOWS\System32\WindowsPowerShell\v1.0\Modules\Defender\MSFT_MpSignature.cdxml; source file in store is also corrupted
2019-07-24 14:56:51, Info CSI 00000347 Hashes for file member [l:13]'Defender.psd1' do not match."
I suppose I should be flattered that Microsoft thinks an end-user would understand this guff, but this particular end-user does not.
Could someone explain why, having just reinstalled Windows 10, some of its files are corrupt? It has taken two days to reinstall Windows 10, my wife's apps and all of her settings. If sfc /scannow knows which files are corrupt, why cannot it simply replace them?
So frustrating - and an utter time-waster. Does anyone have any idea how I can repair or replace the (apparently numerous) corrupted files?
BTW, Windows 10 is hopefully up to date - the most recently installed update is "Feature update to Windows 10, version 1903".
All replies (11)
Thursday, July 25, 2019 2:00 PM âś…Answered | 3 votes
the solution is
sfc /scannow
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /restoreHealth
sfc /scannow
sfc /scannow
Thursday, July 25, 2019 3:09 AM | 1 vote
Hi,
Try the following commands to fix these files:
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /restoreHealth
If they don't work, I suspect the image could be damaged, it's recommended to download the Windows 10 image from the following link and do a clean install:
https://www.microsoft.com/en-us/software-download/windows10
Best regards,
Yilia
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].
Thursday, July 25, 2019 7:31 AM | 1 vote
there is currently a known issue: System File Checker (SFC) incorrectly flags Windows Defender PowerShell module files as corrupted
Thursday, July 25, 2019 10:13 AM | 1 vote
Thank you both for your replies. I ran the three Dism commands, with results as follows:
"Dism /Online /Cleanup-Image /CheckHealth" returned:
No component store corruption detected.
The operation completed successfully.
"Dism /Online /Cleanup-Image /ScanHealth" returned:
The component store is repairable.
The operation completed successfully.
"Dism /Online /Cleanup-Image /restoreHealth" returned:
The restore operation completed successfully.
The operation completed successfully.
However, the first rerun of "sfc /scannow" still returned:
Windows Resource Protection found corrupt files and successfully repaired them. For online repairs, details are included in the CBS log file located at windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline repairs, details are included in the log file provided by the /OFFLOGFILE flag.
But looking at the CBS.log file, there was only one type of error remaining (occurring quite a few times). Here is an example:
2019-07-25 10:34:25, Info CSI 0000007f Warning: Overlap: Directory \?\C:\WINDOWS\System32\drivers\en-US\ is owned twice or has its security set twice
** Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}**
** New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}**
I immediately ran "sfc /scannow" a second time. This time, it returned:
Windows Resource Protection did not find any integrity violations.
So, thank you very much. Problem solved. Most grateful.
Thursday, July 25, 2019 1:49 PM | 1 vote
In closing, I would just point out the disadvantage of downloading a vanilla image of Windows 10 (as recommended above). Not only does one lose everything that was pre-installed by the manufacturer on the particular PC (Lenovo in my wife's case), but - even worse - one cannot trust Microsoft to honour perfectly legal product codes. A few years ago, after another Windows corruption, I installed a vanilla version of Windows and then went to re-install MS Office. But despite my product code being perfectly legal, those nasty people at Microsoft decided to block it. To this day, I have no idea why - despite a most unhelpful conversation with someone at the other end of the Microsoft support line.
I do get the idea that things go wrong with Windows and that a vanilla re-install may often be for the best. But why does it, a) take me two days of effort, and b) provide me with no guarantee that my legally purchased MS Office product code will actually be re-honoured.
MS Office is hugely expensive - yet one has no redress when Microsoft decides not to honour it.
Monday, July 29, 2019 8:52 AM
I can confirm (as mentioned above) that System File Checker (SFC) is flagging Windows Defender PowerShell module files as corrupted. Having got rid of the error messages, I ran "sfc /scannow" again yesterday, only to find that they had come back. Re-running the above dism / dism / dism / sfc / sfc sequence got rid of them again.
Monday, July 29, 2019 9:19 PM
While the "Overlap: Directory xxx is owned twice..." is only a WARNING, is there a good explanation for the warning and if it is not a problem, then SFC should ignore it. Right?
Wednesday, September 25, 2019 1:50 PM
Thank you sir, I got my pc fixed following your instructions.
Saturday, October 5, 2019 7:24 PM
Hi I have win10 home. None of this worked to repair troubleshoot. I have error code 0x80070005 Any other ideas maybe?
Saturday, October 5, 2019 8:16 PM
the error code is ERROR_ACCESS_DENIED .
You are running the commands from an elevated command prompt?
Sunday, October 13, 2019 1:06 AM
The problems reported in the opening post should be fixed by Microsoft updates following dism restorehealth.
These were windows defender hash mismatches (Hashes for file member [l:22]'MSFT_MpSignature.cdxml' do not match.)
The hash mismatches should have been addressed by recent windows updates.
Following the updates run dism /online /cleanup-image /restorehealth and sfc /scannow