Windows 10 SFC errors (common - recurring)

[mechtech]

Just wondering if anyone else gets these?? Seems I get them after every windows update and sometimes more frequently............kind of curious as to root cause, I was thinking make SSD, but I have used several over the years..........maybe nvme or maybe windows shenanigans? Odd thing as well, DSIM scans show all is well..........I ran them before running SFC. Weird stuff.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

 

[chrcoluk]

Essentially I would consider 3 things to be the most likely cause.

1 - Something you did in the past causing SFC to detect errors, such as replacing system files.
2 - Third party tool which modifies system files. Something that patches libraries or binaries e.g.
3 - Defective hardware (or hardware run out of spec) causing corruption.

Read the log for more information.

Also NTLite would be an example of a 3rd party tool, if you start doing things like removing components, then say bye bye to a clean SFC.

I had issues in the past where I used macrium to try and make my PC boot from my first NVME drive (I didnt know the easy fix at the time of booting safe mode to move storage drive to early boot loader), I then later found out macrium made quite a mess, non standard registry keys and a wrong version of the driver, SFC would pick it up but couldnt fix it. A DISM run was able to fix it though, that tool seems much more capable.

I found my thread on the internet, but sadly not the exact command I used.

I was advised to use

DISM.exe /Online /Cleanup-image /Restorehealth

So try that first, but my response of where I stated I had to tweak the command was "I removed the restrict flag as it said it couldnt find source"

Found the exact syntax I ended up using.

If the first DISM command doesnt do the job, try this set of commands.

I would do an OS backup before running DISM.

Dism /mount-wim /wimFile:%USERPROFILE%\Desktop\install.wim /index:1 /MountDir:%USERPROFILE%\Desktop\mount
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /RestoreHealth /Source:%USERPROFILE%\Desktop\mount\windows
Dism /unmount-wim /Mountdir:%USERPROFILE%\Desktop\mount /discard

Then rerun after SFC after to confirm its clean.

 

[Regeneration]

OS corruption can be caused from power outages, BSODs, memory/IMC instability, disk/storage corruption.

Check your drives' .S.M.A.R.T for bad sectors. Run MemTest86 and Prime95/Linpack Xtreme to ensure your system is 100% stable.

Run cmd.exe as admin and type:

chkdsk C: /F /R

Select Y and restart. It may take a while to run a surface scan.

Launch Microsoft Store and ensure all of your OS apps are updated. Also make sure all of Windows updates are installed.

Run cmd.exe as admin and type:

dism /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Restart, and then run DISM and SFC again.

If you still get corrupt files in CBS.log, you'll have to restore these files manually.

Run cmd.exe as admin and type in:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

Open sfcdetails.txt and look for "Cannot repair member file".

If you have another PC or laptop, just copy the missing files and restore with its permissions in the current PC.

 

[mechtech]

Essentially I would consider 3 things to be the most likely cause.

1 - Something you did in the past causing SFC to detect errors, such as replacing system files.
2 - Third party tool which modifies system files. Something that patches libraries or binaries e.g.
3 - Defective hardware (or hardware run out of spec) causing corruption.

Read the log for more information.

Also NTLite would be an example of a 3rd party tool, if you start doing things like removing components, then say bye bye to a clean SFC.

I had issues in the past where I used macrium to try and make my PC boot from my first NVME drive (I didnt know the easy fix at the time of booting safe mode to move storage drive to early boot loader), I then later found out macrium made quite a mess, non standard registry keys and a wrong version of the driver, SFC would pick it up but couldnt fix it. A DISM run was able to fix it though, that tool seems much more capable.

I found my thread on the internet, but sadly not the exact command I used.

I was advised to use

DISM.exe /Online /Cleanup-image /Restorehealth

So try that first, but my response of where I stated I had to tweak the command was "I removed the restrict flag as it said it couldnt find source"

Found the exact syntax I ended up using.

If the first DISM command doesnt do the job, try this set of commands.

I would do an OS backup before running DISM.

Dism /mount-wim /wimFile:%USERPROFILE%\Desktop\install.wim /index:1 /MountDir:%USERPROFILE%\Desktop\mount
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /RestoreHealth /Source:%USERPROFILE%\Desktop\mount\windows
Dism /unmount-wim /Mountdir:%USERPROFILE%\Desktop\mount /discard

Then rerun after SFC after to confirm its clean.

1 - possibly but no clue what?
2 - none installed that I am aware of
3 - possible - nothing OC'd though - and stability tests can run until the cows come home.

I ran DISM first - came back clean no issues found, then ran sfc after and it returned errors.......weird stuff, odd thing is pc runs fine with no (known) issues.........

 

[Regeneration]

Possible - nothing OC'd though - and stability tests can run until the cows come home.

If your PC keeps collecting corrupt OS files AFTER you fixed it once then something isn't stable in your PC.

It is called silent data corruption and if all stability tests come clean then you should try different stress test software and methodology.

Or maybe your NVMe is a bit defective.

 

[mechtech]

OS corruption can be caused from power outages, BSODs, memory/IMC instability, disk/storage corruption.

Check your drives' .S.M.A.R.T for bad sectors. Run MemTest86 and Prime95/Linpack Xtreme to ensure your system is 100% stable.

Run cmd.exe as admin and type:

chkdsk C: /F /R

Select Y and restart. It may take a while to run a surface scan.

Launch Microsoft Store and ensure all of your OS apps are updated. Also make sure all of Windows updates are installed.

Run cmd.exe as admin and type:

dism /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Restart, and then run DISM and SFC again.

If you still get corrupt files in CBS.log, you'll have to restore these files manually.

Run cmd.exe as admin and type in:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

Open sfcdetails.txt and look for "Cannot repair member file".

If you have another PC or laptop, just copy the missing files and restore with its permissions in the current PC.

WMIC says all ok, Prime 95, memtest, linapck, etc. can run 24hrs+ no issues, system is on a UPS. ..................seems to happen more often than not after a windows update. Also when it corrects errors on SFC, says all corrected and no uncorrectables... Chkdsk says ok as well.

If your PC keeps collecting corrupt OS files AFTER you fixed it once then something isn't stable in your PC.

It is called silent data corruption and if all stability tests come clean then you should try different stress test software and methodology.

Or maybe your NVMe is a bit defective.

I was wondering about that...........did the same thing with old samsung nvme as well (different mobo and cpu though)....................maybe I live too far north and getting solar radiation

 

[chrcoluk]

1 - possibly but no clue what?
2 - none installed that I am aware of
3 - possible - nothing OC'd though - and stability tests can run until the cows come home.

I ran DISM first - came back clean no issues found, then ran sfc after and it returned errors.......weird stuff, odd thing is pc runs fine with no (known) issues.........

As some of us have suggested check the SFC log to find out what it is specifically reporting.

If you have tried the second set of DISM commands I gave you and it hasnt helped, or also find you cannot manually fix it, then perhaps an OS reinstall is on the cards, I would diagnose your hardware if its a situation where corruption might be the cause.

 

[Regeneration]

As some of us have suggested check the SFC log to find out what it is specifically reporting.

If you have tried the second set of DISM commands I gave you and it hasnt helped, or also find you cannot manually fix it, then perhaps an OS reinstall is on the cards, I would diagnose your hardware if its a situation where corruption might be the cause.

SFC and DISM are a lot more useful in Windows 10 and newer (unlike Windows 7) and capable of restoring most OS files.

What the OP is trying to say that the problem (corruption) keeps happening over and over again. Silent data corruption.

 

[chrcoluk]

SFC and DISM are a lot more useful in Windows 10 and newer (unlike Windows 7) and capable of restoring most OS files.

What the OP is trying to say that the problem (corruption) keeps happening over and over again. Silent data corruption.

Well he hasnt given an indication he has looked at the log, if SFC cant fix the issue it will appear to be coming back again and again, thats what I was trying to clarify.

If it is indeed coming back again and again, the only sane action is to fix the root cause and then do a new install of the OS so is known good files in place.

But yeah, I was surprised back when I had my nvme driver issue DISM fixed it, was pretty impressed by it.

 

[mechtech]

Well he hasnt given an indication he has looked at the log, if SFC cant fix the issue it will appear to be coming back again and again, thats what I was trying to clarify.

If it is indeed coming back again and again, the only sane action is to fix the root cause and then do a new install of the OS so is known good files in place.

But yeah, I was surprised back when I had my nvme driver issue DISM fixed it, was pretty impressed by it.

Ya I ran all the dism in order and all of the checked out good with no issues. Then run sfc and says found errors and corrected them. I can run it a week later and it’s clean as well sometimes a month later and it’s fine. Seems to happen more often than not after a Windows update. Also checked the log……..it seems pretty big….probably due to test/check? I will have a more thorough look and see if I can find a common denominator or something repeatable.

Well went over the log...C:\Windows\Logs\CBS
and its over my head....... mainly items like this

2023-05-21 12:20:32, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-NetFx4-WCF-US-OC-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1, Remote Parent: NetFx4-AdvSrvs, Parent Missing (ERROR_FILE_NOT_FOUND), non-critical error, ignored, check case sensitivity
2023-05-21 12:20:32, Info CBS Appl: DetectUpdate, Package: Microsoft-Windows-NetFx4-WCF-US-OC-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1, Remote Parent: NetFx4-AdvSrvs, Parent Missing (ERROR_FILE_NOT_FOUND), non-critical error, ignored, check case sensitivity
2023-05-21 12:20:32, Info CBS Appl: DetectUpdate, Package: Containers-Guest-Gated-Package~31bf3856ad364e35~amd64~~10.0.19041.2913, Remote Parent: Containers-Guest-Gating, Parent Missing (ERROR_FILE_NOT_FOUND), non-critical error, ignored, check case sensitivity

and this at the end
2023-05-21 13:21:52, Info CBS Repr: CBS Store check completes
2023-05-21 13:21:52, Info CSI 000004ad StoreCorruptionRepair transaction begun. WcpVersion: [l:38]'10.0.19041.2905 (WinBuild.160101.0800)'.
2023-05-21 13:21:52, Info CSI 000004ae@2023/5/21:17:21:52.711 Starting corruption detection (InnerFlags=2)
2023-05-21 13:21:52, Info CBS FLOW: Entering stage: CheckCsi
2023-05-21 13:22:33, Info CSI 000004af Direct SIL provider: Number of files opened: 85368.
2023-05-21 13:22:33, Info CSI 000004b0@2023/5/21:17:22:33.559 Corruption detection complete. numCorruptions = 0, Disp = 1.
2023-05-21 13:22:33, Info CBS Repr: CSI meta data corruption found, will commit repair transaction if repair is asked.
2023-05-21 13:22:33, Info CBS Repr: CSI Store check completes
2023-05-21 13:22:33, Info CBS FLOW: Entering stage: CheckStagedPackages
2023-05-21 13:22:34, Info CBS Appl:Feature On Demand package without explicit comparator, using GE on build version
2023-05-21 13:22:34, Info CBS Appl:Feature On Demand package without explicit comparator, using GE on build version
2023-05-21 13:22:34, Info CBS Package Format: PSFX
2023-05-21 13:22:34, Info CBS Package Format: PSFX
2023-05-21 13:22:34, Info CBS Appl:LCU package and revision compare set to explicit
2023-05-21 13:22:34, Info CBS Package Format: PSFX
2023-05-21 13:22:34, Info CBS Repr: Staged package check completes
2023-05-21 13:22:34, Info CBS
2023-05-21 13:22:34, Info CBS =================================
2023-05-21 13:22:34, Info CBS Checking System Update Readiness.
2023-05-21 13:22:34, Info CBS Summary:
2023-05-21 13:22:34, Info CBS Operation: Detect only
2023-05-21 13:22:34, Info CBS Operation result: 0x0
2023-05-21 13:22:34, Info CBS Last Successful Step: Stage package detection completes.
2023-05-21 13:22:34, Info CBS Total Detected Corruption: 0
2023-05-21 13:22:34, Info CBS CBS Manifest Corruption: 0
2023-05-21 13:22:34, Info CBS CBS Metadata Corruption: 0
2023-05-21 13:22:34, Info CBS CSI Manifest Corruption: 0
2023-05-21 13:22:34, Info CBS CSI Metadata Corruption: 0
2023-05-21 13:22:34, Info CBS CSI Payload Corruption: 0
2023-05-21 13:22:34, Info CBS Total Repaired Corruption: 0
2023-05-21 13:22:34, Info CBS CBS Manifest Repaired: 0
2023-05-21 13:22:34, Info CBS CSI Manifest Repaired: 0
2023-05-21 13:22:34, Info CBS CSI Payload Repaired: 0
2023-05-21 13:22:34, Info CBS CSI Store Metadata refreshed: True
2023-05-21 13:22:34, Info CBS Staged Packages:
2023-05-21 13:22:34, Info CBS CBS Staged packages: 0
2023-05-21 13:22:34, Info CBS CBS Staged packages removed: 0
2023-05-21 13:22:34, Info CBS
2023-05-21 13:22:34, Info CBS Total Operation Time: 43 seconds.
2023-05-21 13:22:34, Info CBS Ensure CBS corruption flag is clear
2023-05-21 13:22:34, Info CBS Ensure WCP corruption flag is clear
2023-05-21 13:22:34, Info CBS All CSI corruption was fixed, ensure CorruptionDetectedDuringAcr is clear
2023-05-21 13:22:34, Info CBS Failed to clear CorruptionDetectedDuringAcr store corrupt flag (slow mode trigger). [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2023-05-21 13:22:34, Info CBS CheckSur: hrStatus: 0x0 [S_OK], download results: <none>
2023-05-21 13:22:34, Info CBS Count of times corruption detected: 0
2023-05-21 13:22:34, Info CBS Seconds between initial corruption detections: -1
2023-05-21 13:22:34, Info CBS Seconds between corruption and repair: -1
2023-05-21 13:22:34, Info CBS Reboot mark cleared

 

[Regeneration]

You need to check CBS.log just right after SFC is finished.

All the [SR] entries are relevant.

You can filter it by opening cmd.exe and type in:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

It will create a file named sfcdetails.txt just the SR entries.

There it should note every corrupt or missing OS file.

For example:

Info CSI 00000008 [SR] Cannot repair member file [l:34{17}]"Accessibility.dll" of Accessibility, Version = 6.0.6000.16386, pA = PROCESSOR_ARCHITECTURE_MSIL (8), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:b03f5f7f11d50a3a}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing.

Use the System File Checker tool to repair missing or corrupted system files - Microsoft Support

Describes how to use the System File Checker tool to troubleshoot missing or corrupted system files in Windows 8.1, Windows 8, Windows 7 or Windows Vista.

support.microsoft.com

 

[mechtech]

You need to check CBS.log just right after SFC is finished.

All the [SR] entries are relevant.

You can filter it by opening cmd.exe and type in:

findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

It will create a file named sfcdetails.txt just the SR entries.

There it should note every corrupt or missing OS file.

For example:

Info CSI 00000008 [SR] Cannot repair member file [l:34{17}]"Accessibility.dll" of Accessibility, Version = 6.0.6000.16386, pA = PROCESSOR_ARCHITECTURE_MSIL (8), Culture neutral, VersionScope neutral, PublicKeyToken = {l:8 b:b03f5f7f11d50a3a}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing.

Use the System File Checker tool to repair missing or corrupted system files - Microsoft Support

Describes how to use the System File Checker tool to troubleshoot missing or corrupted system files in Windows 8.1, Windows 8, Windows 7 or Windows Vista.

support.microsoft.com

thanks........thats the MS link I used and followed

I manually went through the log for the [SR] just to see if there was a problem child, but weird thing is nothing really showed up

2023-05-16 20:10:37, Info CSI 00000200 [SR] Repairing 1 components
2023-05-16 20:10:37, Info CSI 00000201 [SR] Beginning Verify and Repair transaction
2023-05-16 20:10:37, Info CSI 00000202 [SR] Repairing file \??\C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\\OneDrive.lnk from store
2023-05-16 20:10:37, Info CSI 00000203 [SR] Repair complete
2023-05-16 20:10:37, Info CSI 0000020b [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired
2023-05-16 20:12:38, Info CBS Trusted Installer is shutting down because: SHUTDOWN_REASON_AUTOSTOP

lots of these (from original post w/ errors)
2023-05-21 13:27:03, Info CSI 000004fa [SR] Verifying 100 components
2023-05-21 13:27:03, Info CSI 000004fb [SR] Beginning Verify and Repair transaction
2023-05-21 13:27:04, Info CSI 000004fc [SR] Verify complete

a few of these (original post time scan)
2023-05-21 13:29:36, Info CSI 00000529 [SR] Verifying 100 components
2023-05-21 13:29:36, Info CSI 0000052a [SR] Beginning Verify and Repair transaction
2023-05-21 13:29:36, Info CSI 0000052b Warning: Overlap: Directory \??\C:\Windows\System32\drivers\en-US\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2023-05-21 13:29:36, Info CSI 0000052c Warning: Overlap: Directory \??\C:\Windows\System32\wbem\en-US\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2023-05-21 13:29:36, Info CSI 0000052d Warning: Overlap: Directory \??\C:\Windows\help\mui\0409\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}
2023-05-21 13:29:36, Info CSI 0000052e [SR] Verify complete

ending
2023-05-21 13:48:53, Info CSI 000006aa [SR] Verifying 55 components
2023-05-21 13:48:53, Info CSI 000006ab [SR] Beginning Verify and Repair transaction
2023-05-21 13:48:53, Info CSI 000006ac [SR] Verify complete
2023-05-21 13:48:53, Info CSI 000006ad [SR] Repairing 0 components
2023-05-21 13:48:53, Info CSI 000006ae [SR] Beginning Verify and Repair transaction
2023-05-21 13:48:53, Info CSI 000006af [SR] Repair complete

 

[Regeneration]

It says there is nothing wrong at the moment. All OS files are verified.