Using SFC (System File Checker) To Repair Server 2008 Issues

Both Windows Vista and Windows Server 2008 include the System File Checker (SFC) tool. Previous operating systems included this tool also. This discussion is specific to Windows Vista and Windows Server 2008. If you would like more information on previous operating systems see the following KB article: http://support.microsoft.com/kb/310747.

SFC scans and checks all Windows Resource Protected (WRP) resources. Windows Vista adds the following new functionality to the SFC tool:

• Ability to scan a single file
• Ability to scan a Windows installation offline

Common SFC Command Line Options

Here are some of the common commands you would use with SFC. Note you need to run SFC from a elevated command prompt

Scan entire system
SFC.EXE /scannow

Scan a specific file
SFC.EXE /scanfile=c:\windows\system32\kernel32.dll

Verify. This scans all protected files but does not repair them
SFC.EXE /verifyonly

Help for Sfc.exe
SFC.EXE /?

One of the new features of SFC in Windows Vista/2008 is the ability to run SFC against a offline windows directory. This is most useful when you are unable to start Windows and suspect file corruption. Generally you should always try safe mode first before doing this to see if Windows can start. To use SFC in offline mode you do the following

1. Boot from your Windows Vista or Windows Server 2008 DVD
2. On the first screen of Setup choose Next
3. In the lower left of the screen choose “repair your computer”
4. On the System Recovery Options screen choose your installation of Windows and then click next
5. Click “Command prompt”
6. Type in the following command: SFC.EXE /scannow /offbootdir=c:\ /offwindir=c:\windows
7. When complete type in exit to see if Windows starts up now.

Advanced users may want to see what SFC is repairing on a system. When SFC runs it logs it’s actions to C:\WINDOWS\LOGS\CBS\CBS.LOG. You can find SFC specific entries by searching on [SR]. See http://support.microsoft.com/default.aspx/kb/928228 for more information.

Example of How SFC Can Fix Issues

The following is a example of how the system file checker was able to resolve a issue on my own computer. The issue I encountered was that When I would go into disk management my disks would show up but none of the information such as the type of disk, size, active/boot/system, healthy, etc… would show up. I checked the system event log and found the following

FMIFS.DLL is obviously a file used by disk management to display this information. If I look up the error code C1 it resolves to ERROR_BAD_EXE_FORMAT. So at this point I suspect that this file is corrupt. From within Windows I run the following command:

SFC.EXE /scannow

It runs and says that it has repaired files. To verify I look in the C:\WINDOWS\LOGS\CBS\CBS.LOG and see the following entries

From this you can tell that SFC compared the hash for fmifs.dll and found it wasn’t correct. It restored the backup from c:\windows\WinSxS\x86_microsoft-windows-fmifs_31bf3856ad364e35_6.0.6000.16386_none_54d7af8934ac24f1. After running SFC I was now able to open disk management and see my disk information.

Hopefully this helps explain how SFC can help you resolve problems on your computer and shows how Microsoft is committed to making Windows easier to fix when issues do occur.

Author:
Scott McArthur
Support Escalation Engineer
Enterprise Platforms Support