How to repair Windows Server using Windows SFC and DISM
Administrators can diagnose and treat a buggy server operating system by using the Windows SFC and DISM utilities for image analysis and repairs.
Over time, system files in a Windows Server installation might require a fix. You can often repair the operating system without taking the server down by using Windows SFC or the more robust and powerful Deployment Image Servicing and Management commands.
Windows System File Checker (SFC) and Deployment Image Servicing and Management (DISM) are administrative utilities that can alter system files, so they must be run in an administrator command prompt window.
Start with Windows SFC
The Windows SFC utility scans and verifies version information, file signatures and checksums for all protected system files on Windows desktop and server systems. If the command discovers missing protected files or alterations to existing ones, Windows SFC will attempt to replace the altered files with a pristine version from the %systemroot%\system32\dllcache folder.
The system logs all activities of the Windows SFC command to the %Windir%\CBS\CBS.log file. If the tool reports any nonrepairable errors, then you'll want to investigate further. Search for the word corrupt to find most problems.
Windows SFC command syntax
Open a command prompt with administrator rights and run the following command to start the file checking process:
C:\Windows\System32>sfc /scannow
The /scannow parameter instructs the command to run immediately. It can take some time to complete -- up to 15 minutes on servers with large data drives is not unusual -- and usually consumes 60%-80% of a single CPU for the duration of its execution. On servers with more than four cores, it will have a slight impact on performance.
There are times Windows SFC cannot replace altered files. This does not always indicate trouble. For example, recent Windows builds have included graphics driver data that was reported as corrupt, but the problem is with Windows file data, not the files themselves, so no repairs are needed.
If Windows SFC can't fix it, try DISM
The DISM command is more powerful and capable than Windows SFC. It also checks a different file repository -- the %windir%\WinSXS folder, aka the "component store" -- and is able to obtain replacement files from a variety of potential sources. Better yet, the command offers a quick way to check an image before attempting to diagnose or repair problems with that image.
Run DISM with the following parameters:
C:\Windows\System32>dism /Online /Cleanup-Image /CheckHealth
Even on a server with a huge system volume, this command usually completes in less than 30 seconds and does not tax system resources. Unless it finds some kind of issue, the command reports back "No component store corruption detected." If the command finds a problem, this version of DISM reports only that corruption was detected, but no supporting details.
Corruption detected? Try ScanHealth next
If DISM finds a problem, then run the following command:
C:\Windows\System32>dism /Online /Cleanup-Image /ScanHealth
This more elaborate version of the DISM image check will report on component store corruption and indicate if repairs can be made.
If corruption is found and it can be repaired, it's time to fire up the /RestoreHealth directive, which can also work from the /online image, or from a different targeted /source.
Run the following commands using the /RestoreHealth parameter to replace corrupt component store entries:
C:\Windows\System32>dism /Online /Cleanup-Image /RestoreHealth
C:\Windows\System32>dism /source:<spec> /Cleanup-Image /RestoreHealth
You can drive file replacement from the running online image easily with the same syntax as the preceding commands. But it often happens that local copies aren't available or are no more correct than the contents of the local component store itself. In that case, use the /source directive to point to a Windows image file -- a .wim file or an .esd file -- or a known, good, working WinSXS folder from an identically configured machine -- or a known good backup of the same machine to try alternative replacements.
By default, the DISM command will also try downloading components from the Microsoft download pages; this can be turned off with the /LimitAccess parameter. For details on the /source directive syntax, the TechNet article "Repair a Windows Image" is invaluable.
DISM is a very capable tool well beyond this basic image repair maneuver. I've compared it to a Swiss army knife for maintaining Windows images. Windows system admins will find DISM to be complex and sometimes challenging but well worth exploring.
