What is the purpose of the DISM /RestoreHealth parameter and SFC?

Question

What is the purpose of the DISM /RestoreHealth parameter and the SFC /ScanNow parameter?

• How do they correlate to one another?
• In what order should they be run?
• Why does the order sequence matter when executing either?

Answer 1

The Component Store [%WinDir%\WinSxS] maintains a backup copy of all Windows system files, and SFC [System File Checker] & DISM [Deployment Image Servicing and Management] manage two separate, vital pieces of the Component Store and OS, with SFC relying entirely upon what DISM manages:

• DISM has two functions SFC relies upon, /StartComponentCleanup and /RestoreHealth, with /RestoreHealth relying solely upon /StartComponentCleanup
  • /StartComponentCleanup: Cleans the Component Store of any broken hard links
    (It's imperative folks on Insider Builds run this regularly due to the frequent updates)
  • /RestoreHealth: Verifies and fixes any corruption in the Component Store by verifying it's system file backups against known good copies from the Windows Update servers through hash comparison; while an offline method does exist [below], it may not always fix the corruption
    • Windows 7: SUR [System Update Readiness] tool is used in lieu of this, as DISM didn't have this functionality until Windows 8, with SUR operating differently than DISM
      
      
• SFC always assumes the Component Store is not corrupted and is why the DISM /RestoreHealth parameter should always be run prior to SFC; not doing so allows a corrupted Component Store to potentially replace a good system file with a corrupted one or fail to fix corruption within %WinDir% altogether
  • /ScanNow: Verifies and fixes any corruption within %WinDir% by verifying against the known good copies within the Component Store through hash comparison
    
    

SFC and DISM will not resolve hardware related issues, as they only resolve OS system file corruption, excluding Registry hives and user config files within %WinDir%\System32\drivers\etc.

---

DISM and SFC must be executed in the order listed:
^{(Each relies upon what the preceding does; if Windows 7: skip to #3)}

1. +R → Open: PowerShell → Ctrl+Shift+OK

   # Windows ≥8:
     # Online [booted to Windows]:
       Dism /Online /Cleanup-Image /StartComponentCleanup
   
     # Offline [mounted WIM, possibly when booted to a different Windows install]:
       Dism /Image:"Z:\Windows" /Cleanup-Image /StartComponentCleanup
   

   The Component Store should always be cleaned prior to running Windows Update, after an issue with Windows Update, and at least once a month, as it becomes dirty over time from updates occasionally breaking hard links.
   
   

2. # Windows ≥8:
     # Online [booted to Windows]:
       Dism /Online /Cleanup-Image /RestoreHealth
   
     # Offline [mounted WIM, or when booted to WinPE/WinRE or different Windows install]:
       Dism /Image:"Z:\Windows" /Cleanup-Image /RestoreHealth
   

   Requires an internet connection, else the offline method will be required:
   • Use the install.<esd|wim> from the Windows Install ISO for the installed version:
     1. Create Windows <#> installation media → Download tool now → install on another PC
     2. Mount ISO to determine installed OS index [image] from its install.<esd|wim>:

        Dism /Get-ImageInfo /ImageFile:"Z:\sources\install.<esd|wim>"
        

     3. Specify index number at the end of the /Source parameter:

        # Online [booted to Windows]:
          # ESD:
            Dism /Online /Cleanup-Image /RestoreHealth /Source:esd:"Z:\sources\install.esd":6 /LimitAccess
        
          # WIM:
            Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:"Z:\sources\install.wim":6 /LimitAccess
        
        # Offline [mounted WIM, or when booted to WinPE/WinRE or different Windows install]:
          Dism /Image:"Z:\Windows" /Cleanup-Image /RestoreHealth /Source:esd:"Z:\sources\install.esd":6 /LimitAccess
        

        
        
3. Windows 7: Run the SUR tool
4. Reboot; if errors are found, review %WinDir%\Logs\DISM\dism.log from the bottom up
   ^{(Log files are easier to read and sift through via the Log syntax in VS Code)}
   • Windows ≥8: %WinDir%\Logs\DISM\dism.log
   • Windows 7: %WinDir%\Logs\CBS\CheckSUR.log
     ^{(How to fix SUR errors)}
     
     

5. # Online [booted to Windows]:
     Sfc /ScanNow
   
   # Offline [booted to WinPE/WinRE or different Windows install]:
     Sfc /ScanNow /OffBootDir=Z:\ /OffWinDir=Z:\Windows
     # C: is usually not the drive letter in WinPE/WinRE
     # To ascertain: DiskPart → Lis Vol → Exit
   

   
   
6. Reboot; if errors are found, output to %UserProfile%\Desktop\SFCdetails.log and review:

   # Cmd:
     FindStr /c:"[SR]" "%WinDir%\Logs\CBS\CBS.log" > "%UserProfile%\Desktop\SFCdetails.log"
   
   # PowerShell:
     FindStr /c:"[SR]" "$env:WinDir\Logs\CBS\CBS.log" > "$env:UserProfile\Desktop\SFCdetails.log"
   

---

I run these weekly via Task Scheduler to help prevent random issues from occurring:

1. Dism_ComponentCleanup.xml
   Executes weekly on Sundays at 11:30:00
2. Dism_RestoreHealth.xml
   Executes weekly on Sundays at 12:00:00
3. Sfc_ScanNow.xml
   Executes weekly on Sundays at 13:00:00
   
   

Import into Task Scheduler:

• GUI:
  1. +R → Open: TaskSchd.msc
  2. Action → New Folder... → Name: Custom
  3. Action → Import Task... → <task_name>.xml
     
     
• CLI:
  • Cmd:

    SchTasks /Create /Xml "%UserProfile%\Downloads\<task_name>.xml" /Tn "\Custom\Task Name" /Ru "%ComputerName%\%UserName%"
    

  • Powershell:

    Register-ScheduledTask -Xml (Get-Content '$env:UserProfile\Downloads\<task_name>.xml' | Out-String) -TaskName "Task Name" -TaskPath "\Custom\" -User $env:ComputerName\$env:UserName –Force