Problem solve Get help with specific problems with your technologies, process and projects.

Enlist Windows SFC and DISM tools to fix server OS problems

Administrators can diagnose and treat a buggy server operating system by using the Windows DISM and SFC utilities for image analysis and repairs.

Over time, system files in a Windows Server installation may become damaged or corrupt. An administrator can often...

repair the operating system without taking the server down by using the built-in System File Checker or the more robust and powerful Deployment Image Servicing and Management commands.

Windows System File Checker (SFC) and Deployment Image Servicing and Management (DISM) are administrative utilities that can alter system files, so they must be run in an administrator command prompt window.

Start with System File Checker

The Windows SFC utility scans and verifies version information, file signatures and checksums for all protected system files on Windows desktop and server systems. If the command discovers any protected files have been altered or overwritten, it will attempt to replace the altered files with a pristine version from the %systemroot%\system32\dllcache folder. All activities of the SFC command are logged to the %Windir%\CBS\CBS.log file. If any nonrepairable errors are reported, then you'll want to investigate the files involved. Search for the word "corrupt" to find most problems.

Windows SFC command syntax

C:\Windows\System32> sfc /scannow

The /scannow directive instructs the command to run immediately. It can take some time to complete -- up to 15 minutes on servers with large data drives is not unusual -- and usually consumes 60%-80% of a single CPU for the duration of its execution. On servers with more than four cores, it will have a slight impact on performance.

There are times the SFC will not be able to replace files it detects as altered. This does not always indicate trouble. For example, recent Windows builds have included graphics driver data that was reported as corrupt, but the problem is with Windows file data, not the files themselves, so there's nothing to fix.

If SFC can't fix it, try Windows DISM

The Windows DISM command is more powerful and capable than the SFC. It also checks a different file repository -- the %windir%\WinSXS folder, aka the "component store" -- and is able to obtain replacement files from a variety of potential sources. Better yet, the command offers a quick way to check an image before attempting to diagnose or repair problems with that image.

The Windows SFC utility scans and verifies version information, file signatures and checksums for all protected system files on Windows desktop and server systems.

CheckHealth command syntax

C:\Windows\System32> dism /Online /Cleanup-Image /CheckHealth

Even on a server with a huge system volume, this command usually completes in less than 30 seconds and does not tax system resources. Unless it finds some kind of issue, the command reports back "No component store corruption detected." If the command does find a problem, this version of DISM reports only that corruption was detected, but no supporting details.

Corruption detected? Try ScanHealth next

C:\Windows\System32> dism /Online /Cleanup-Image /ScanHealth

This more elaborate version of the DISM image check will report on component store corruption and indicate if repairs can be made. If corruption is found and it can be repaired, it's time to fire up the /RestoreHealth directive, which can also work from the /online image, or from a different targeted /source.

RestoreHealth replaces corrupt component store entries

C:\Windows\System32> dism /Online /Cleanup-Image /RestoreHealth

C:\Windows\System32> dism /source:<spec> /Cleanup-Image /RestoreHealth

You can drive file replacement from the running online image easily with the same syntax as the preceding commands. But it often happens that local copies aren't available or are no more correct than the contents of the local component store itself. In that case, use the /source directive to point to a Windows image file -- a .wim file or an .esd file -- or a known, good, working WinSXS folder from an identically configured machine -- or a known good backup of the same machine to try alternative replacements. By default, the DISM command will also try downloading components from the Microsoft download pages; this can be turned off by using the /LimitAccess directive. For details on the /source directive syntax, the TechNet article "Repair a Windows Image" is invaluable.

DISM is a very capable tool well beyond this basic image repair maneuver. I've compared it to a Swiss army knife for maintaining Windows images. Windows system admins will find DISM to be complex and sometimes challenging but well worth exploring.

Next Steps

Networking enhancements coming in Windows Server 2016

How data deduplication works in Windows Server 2012 R2

Manage a library of images for Windows deployment

Dig Deeper on Windows Server troubleshooting

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

What are some utilities or techniques you use to ensure file integrity with the Windows Server OS?