What is the purpose of the DISM
/RestoreHealth
parameter and the SFC
/ScanNow
parameter?
- How do they correlate to one another?
- In what order should they be run?
- Why does the order sequence matter when executing either?
The Component Store [%WinDir%\WinSxS
] maintains a backup copy of all Windows system files, and SFC
[System File Checker] & DISM
[Deployment Image Servicing and Management] manage two separate, vital pieces of the Component Store and OS, with SFC
relying entirely upon what DISM
manages:
DISM
has two functions SFC
relies upon, /StartComponentCleanup
and /RestoreHealth
, with /RestoreHealth
relying solely upon /StartComponentCleanup
/StartComponentCleanup
: Cleans the Component Store of any broken hard links /RestoreHealth
: Verifies and fixes any corruption in the Component Store by verifying it's system file backups against known good copies from the Windows Update servers through hash comparison; while an offline method does exist [below], it may not always fix the corruption
DISM
didn't have this functionality until Windows 8, with SUR operating differently than DISM
SFC
always assumes the Component Store is not corrupted and is why the DISM
/RestoreHealth
parameter should always be run prior to SFC
; not doing so allows a corrupted Component Store to potentially replace a good system file with a corrupted one or fail to fix corruption within %WinDir%
altogether
/ScanNow
: Verifies and fixes any corruption within %WinDir%
by verifying against the known good copies within the Component Store through hash comparison SFC
and DISM
will not resolve hardware related issues, as they only resolve OS system file corruption, excluding Registry hives, non-OS bundled drivers, and user config files within:
%WinDir%\System32\drivers\etc
DISM
and SFC
must be executed in the order listed:
(Each is hierarchical, relying upon what the preceding does | Windows 7: skip to #3)
powershell
→ Ctrl+Shift+OK
# Windows ≥8:
# Online [booted Windows image]:
Dism /Online /Cleanup-Image /StartComponentCleanup
# Offline [non-booted Windows image]:
Dism /Image:"Z:\Windows" /Cleanup-Image /StartComponentCleanup
Cmdlet:
# Online:
Repair-WindowsImage -Online -StartComponentCleanup
# Offline:
Repair-WindowsImage -Path "Z:\Windows" -StartComponentCleanup
The Component Store should always be cleaned prior to running Windows Update, after an issue with Windows Update, and at least once a month, as it becomes dirty over time from updates occasionally breaking hard links. # Windows ≥8:
# Online [booted Windows image]:
Dism /Online /Cleanup-Image /RestoreHealth
# Offline [non-booted Windows image]:
Dism /Image:"Z:\Windows" /Cleanup-Image /RestoreHealth
Cmdlet:
# Online:
Repair-WindowsImage -Online -RestoreHealth
# Offline:
Repair-WindowsImage -Path "Z:\Windows" -RestoreHealth
Requires an internet connection, else the offline method will be required:
install.<esd|wim>
from the Windows Install ISO for the installed version:
install.<esd|wim>
:
Dism /Get-ImageInfo /ImageFile:"Y:\sources\install.<esd|wim>"
Cmdlet:
Get-WindowsImage -ImagePath "Y:\sources\install.<esd|wim>"
/Source
parameter:
# Online [booted Windows image]:
# ESD:
Dism /Online /Cleanup-Image /RestoreHealth /Source:esd:"Y:\sources\install.esd":6 /LimitAccess
# WIM:
Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:"Y:\sources\install.wim":6 /LimitAccess
# Offline [non-booted Windows image]:
Dism /Image:"Z:\Windows" /Cleanup-Image /RestoreHealth /Source:esd:"Y:\sources\install.esd":6 /LimitAccess
Cmdlet:
# Requires mounting ESD/WIM first:
# Determine a partition to mount on:
Gdr -PSProvider 'FileSystem'
# Create Mount directory and mount ESD/WIM index:
Mkdir "C:\Mount"
Mount-WindowsImage -ImagePath "Y:\sources\install.<esd|wim>" -Index 6 -Path "C:\Mount" -ReadOnly
# Either Source can be used: Mount\Windows || Mount\Windows\WinSxS
Repair-WindowsImage -Image "Z:\Windows" -RestoreHealth -Source "C:\Mount\Windows"
%WinDir%\Logs\DISM\dism.log
from the bottom up %WinDir%\Logs\DISM\dism.log
%WinDir%\Logs\CBS\CheckSUR.log
# Online [booted Windows image]:
Sfc /ScanNow
# Offline [non-booted Windows image / booted to WinPE/WinRE]:
Sfc /ScanNow /OffBootDir=Z:\ /OffWinDir=Z:\Windows
# C: is usually not the drive letter in WinPE/WinRE
# To ascertain: DiskPart → lis vol → exit
%UserProfile%\Desktop\SFCdetails.log
and review:
# Cmd:
FindStr /c:"[SR]" "%WinDir%\Logs\CBS\CBS.log" > "%UserProfile%\Desktop\SFCdetails.log"
# PowerShell:
FindStr /c:"[SR]" "$env:WinDir\Logs\CBS\CBS.log" > "$env:UserProfile\Desktop\SFCdetails.log"
I run these weekly via Task Scheduler to help prevent random issues from occurring:
Dism_ComponentCleanup.xml
Dism_RestoreHealth.xml
Sfc_ScanNow.xml
Import into Task Scheduler:
Cmd
:
SchTasks /Create /Xml "%UserProfile%\Downloads\<task_name>.xml" /Tn "\Custom\Task Name" /Ru "%ComputerName%\%UserName%"
Powershell
:
Register-ScheduledTask -Xml (Get-Content '$env:UserProfile\Downloads\<task_name>.xml' | Out-String) -TaskName "Task Name" -TaskPath "\Custom\" -User $env:ComputerName\$env:UserName –Force
/RestoreHealth
, so either something changed or I overlooked a step since I use a custom-built WinRE/WinPE image and a standalone dism.exe
from the ADK.
/StartComponentCleanup
and /RestoreHealth
regularly, as a dirty Component Store will cause issues with Windows Update, Add/Remove Features, etc. (the Component Store is how Windows is serviced and where drivers are backed up to prior to a bi-annual update), and while Microsoft doesn't recommend running /StartComponentCleanup
prior to /RestoreHealth
, I do since a dirty Component Store will often cause /RestoreHealth
to fail