Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)

A copy of Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe) (kb310747)

SUMMARY

This article describes System File Checker (Sfc.exe), which is a command-line utility used with the Windows File Protection (WFP) feature.

MORE INFORMATION

System File Checker gives an administrator the ability to scan all protected files to verify their versions. If System File Checker discovers that a protected file has been overwritten, it retrieves the correct version of the file from the cache folder (%Systemroot%\System32\Dllcache) or the Windows installation source files, and then replaces the incorrect file. System File Checker also checks and repopulates the cache folder. You must be logged on as an administrator or as a member of the Administrators group to run System File Checker. If the cache folder becomes damaged or unusable, you can use the sfc /scannow, the sfc /scanonce, or the sfc /scanboot commands to repair its contents.

System File Checker Tool Syntax

Sfc [/Scannow] [/Scanonce] [/Scanboot] [/Revert] [/Purgecache] [/Cachesize=x]
  • /Scannow: Scans all protected system files immediately and replaces incorrect versions with correct Microsoft versions. This command may require access to the Windows installation source files.
  • /Scanonce: Scans all protected system files one time when you restart your computer. This command may require access to the Windows installation source files when you restart the computer. The SfcScan DWORD value is set to 2 in the following registry key when you run this command:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  • /Scanboot: Scans all protected system files every time you start your computer. This command may require access to the Windows installation source files every time you start your computer. The SfcScan DWORD value is set to 1 in the following registry key when you run this command:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  • /Revert: Returns scan to the default setting (do not scan protected files when you start the computer).The default cache size is not reset when you run this command. This command is equivalent to the /Enable switch in Windows 2000.
  • /Purgecache: Purges the file cache and scans all protected system files immediately. This command may require access to the Windows installation source files.
  • /Cachesize=x: Sets the file cache size to x megabytes (MB). The default size of the cache is 50 MB. This command requires you to restart the computer, and then run the /purgecache command to adjust the size of the on-disk cache. This command sets the SfcQuota DWORD value to x in the following registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

For additional information about the Windows File Protection feature, click the article number below to view the article in the Microsoft Knowledge Base:

222193 Description of the Windows 2000 Windows File Protection Feature

Article ID: 310747 – Last Review: December 1, 2007 – Revision: 4.8
APPLIES TO
  • Microsoft Windows Server 2003, 64-Bit Datacenter Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional x64 Edition
  • Microsoft Windows XP Media Center Edition 2005 Update Rollup 2
  • Microsoft Windows XP Tablet PC Edition

Keywords:
kbinfo KB310747

The results are on the command line screen, and not in the event viewer (eventvwr.exe), but more results are in c:\Windows\Logs\CBS\CBS.log

You’re looking for lines like:

2014-08-30 17:08:12, Info                  CSI    00000009 [SR] Verifying 100 (0x0000000000000064) components
2014-08-30 17:08:12, Info                  CSI    0000000a [SR] Beginning Verify and Repair transaction
2014-08-30 17:08:15, Info                  CSI    0000000b Repair results created:
POQ 0 starts:
 
POQ 0 ends.

and looking for errors like

2014-08-30 17:08:16, Info                  CSI    00000008 [SR] Repairing corrupted file [ml:520{260},l:108{54}]"\??\E:\Program Files\Common Files\Microsoft Shared\DAO"\[l:20{10}]"dao360.dll" from store

2 thoughts on “Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)

  1. Pingback: Windows File Protection | Montgomery Minds

  2. Pingback: Description of the Windows File Protection feature – Detailed | Montgomery Minds

Leave a Reply

Your email address will not be published. Required fields are marked *