System File Checker gives an administrator the ability to scan all protected files to verify their versions. If System File Checker discovers that a protected file has been overwritten, it retrieves the correct version of the file from the cache folder (%Systemroot%\System32\Dllcache) or the Windows installation source files, and then replaces the incorrect file. System File Checker also checks and repopulates the cache folder. You must be logged on as an administrator or as a member of the Administrators group to run System File Checker. If the cache folder becomes damaged or unusable, you can use the sfc /scannow, the sfc /scanonce, or the sfc /scanboot commands to repair its contents.

System File Checker Tool Syntax

• /Scannow: Scans all protected system files immediately and replaces incorrect versions with correct Microsoft versions. This command may require access to the Windows installation source files.
• /Scanonce: Scans all protected system files one time when you restart your computer. This command may require access to the Windows installation source files when you restart the computer. The SfcScan DWORD value is set to 2 in the following registry key when you run this command:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

• /Scanboot: Scans all protected system files every time you start your computer. This command may require access to the Windows installation source files every time you start your computer. The SfcScan DWORD value is set to 1 in the following registry key when you run this command:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

• /Revert: Returns scan to the default setting (do not scan protected files when you start the computer).The default cache size is not reset when you run this command. This command is equivalent to the /Enable switch in Windows 2000.
• /Purgecache: Purges the file cache and scans all protected system files immediately. This command may require access to the Windows installation source files.
• /Cachesize=x: Sets the file cache size to x megabytes (MB). The default size of the cache is 50 MB. This command requires you to restart the computer, and then run the /purgecache command to adjust the size of the on-disk cache. This command sets the SfcQuota DWORD value to x in the following registry key:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

For additional information about the Windows File Protection feature, click the article number below to view the article in the Microsoft Knowledge Base:

The results are on the command line screen, and not in the event viewer (eventvwr.exe), but more results are in c:\Windows\Logs\CBS\CBS.log

You’re looking for lines like:

2014-08-30 17:08:12, Info                  CSI    00000009 [SR] Verifying 100 (0x0000000000000064) components
2014-08-30 17:08:12, Info                  CSI    0000000a [SR] Beginning Verify and Repair transaction
2014-08-30 17:08:15, Info                  CSI    0000000b Repair results created:
POQ 0 starts:
 
POQ 0 ends.

and looking for errors like

2014-08-30 17:08:16, Info                  CSI    00000008 [SR] Repairing corrupted file [ml:520{260},l:108{54}]"\??\E:\Program Files\Common Files\Microsoft Shared\DAO"\[l:20{10}]"dao360.dll" from store