How to Fix Windows Resource Protection Errors with sfc and DISM

Applies to: Windows Server 2016 and later, Windows 10 and 11 (commands from Microsoft documentation, not tested by us)

"Windows Resource Protection" messages come from the System File Checker, sfc /scannow. The two errors have different fixes:

• "Windows Resource Protection could not start the repair service": this usually means the Windows Modules Installer service (TrustedInstaller), which sfc relies on, is disabled. Set it back to Manual, start it and run sfc again.
• "Windows Resource Protection could not perform the requested operation": Microsoft's fix is to run the scan in safe mode and to make sure the PendingDeletes and PendingRenames folders exist under %WinDir%\WinSxS\Temp. Run DISM first so sfc has a healthy source to repair from.

The steps below follow Microsoft's documentation and include what changes when the machine is a Windows Server VPS that you reach over Remote Desktop.

What each sfc result means

• "Windows Resource Protection did not find any integrity violations." Your protected system files are fine. Look for the problem elsewhere (drivers, updates, applications, disk).
• "Windows Resource Protection found corrupt files and successfully repaired them." The repair worked.
• "Windows Resource Protection found corrupt files but was unable to fix some of them." Some files could not be restored from the component store. Repair the store with DISM, then scan again (see below).
• "Windows Resource Protection could not perform the requested operation." The scan could not run. Use safe mode (see below).
• "Windows Resource Protection could not start the repair service." The service sfc needs could not be started, usually because it is disabled.

Step 1: Run DISM, then sfc, as administrator

sfc replaces damaged files with clean copies from the Windows component store (C:\Windows\WinSxS). If that store is damaged, sfc cannot finish. DISM repairs the store first. Microsoft's order is DISM, then sfc.

1. Open Command Prompt as administrator (search for cmd, right-click Command Prompt, Run as administrator). sfc only works for members of the Administrators group.
2. Repair the component store. According to Microsoft it may take several minutes:

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   To check first without repairing, DISM /Online /Cleanup-Image /ScanHealth scans, and /CheckHealth then reports whether the image is healthy, repairable or non-repairable.
3. Scan and repair the system files:

   sfc /scannow

By default DISM downloads clean files from Windows Update, so the server needs internet access. On servers that get updates from WSUS, the Group Policy setting "Specify settings for optional component installation and component repair" decides where repair content comes from.

Fix "could not start the repair service"

sfc uses the Windows Modules Installer service, service name TrustedInstaller. Microsoft lists its startup type as Manual and warns that if it is disabled, installing or removing Windows updates might fail too.

1. In an administrator Command Prompt, set it back to Manual (demand) and start it. The space after start= is required:

   sc.exe config trustedinstaller start= demand
   net start trustedinstaller

2. Run sfc /scannow again.

If the service will not start, run the DISM command from step 1, restart the server and try once more.

Fix "could not perform the requested operation"

1. Run the DISM command from step 1 if you have not already.
2. Check that the two folders Microsoft mentions exist:

   dir %WinDir%\WinSxS\Temp

   The list should include PendingDeletes and PendingRenames.
3. Still failing: run sfc in safe mode (next section).

Running sfc in safe mode on a Windows Server VPS

Important: according to Microsoft, Remote Desktop does not start in safe mode, neither in Minimal nor in the Network variant. On a VPS or dedicated server you need the provider's console: VNC on a VPS (how to access your VPS through VNC in Virtualizor) or the IPMI console on a dedicated server. Open the console and check you can log in there before you continue.

1. Switch on safe mode for the next restarts. Either run msconfig, open the Boot tab, tick Safe boot (Minimal) and click OK, or use:

   bcdedit /set {current} safeboot minimal

2. Restart, log in through the console and open Command Prompt as administrator.
3. Run sfc /scannow.
4. Switch safe mode off again, otherwise the server keeps starting without Remote Desktop:

   bcdedit /deletevalue {current} safeboot

   (or clear Safe boot on the Boot tab of msconfig), then restart. bcdedit /enum shows a safeboot line under Windows Boot Loader while safe mode is still set.

If Windows does not start at all, sfc can also scan an offline Windows installation from the recovery environment of the installation media, with /offbootdir and /offwindir, for example sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows. Check with dir first which drive letter holds the Windows folder there, because it is often not C:.

Fix "found corrupt files but was unable to fix some of them"

1. Run the DISM command from step 1, restart, and run sfc /scannow again.
2. If DISM fails with Error: 0x800f081f, "The source files could not be found", Windows Update could not supply the files. Point DISM at installation media for the same Windows version, edition and language. Mount the ISO (here as drive D:), list the editions in it and note the index of yours:

   Dism /Get-ImageInfo /ImageFile:D:\sources\install.wim

   Then repair from that index (here 2) without contacting Windows Update:

   DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:D:\sources\install.wim:2 /LimitAccess

   Microsoft notes that the source should be patched to at least the same cumulative update level as the server; an older source can still fail. The DISM log is C:\Windows\Logs\DISM\dism.log.
3. To see which files sfc could not repair, extract the sfc lines from the CBS log to a file on your desktop:

   findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

   Microsoft describes replacing a file by hand with a known good copy from a computer with the same Windows version: takeown /f on the file, icacls ... /grant administrators:F, then copy.

On a Windows VPS where nothing repairs the system, restoring a backup or reinstalling the operating system can be faster than more repair attempts. Copy your data off first: a reinstall erases the disk (reinstall the VPS operating system from the Ucartz client area). If you cannot mount an ISO on your VPS yourself, ask your provider's support.

Related articles: Windows 10 slow after an update: System File Checker, Windows Update errors, reboot a Windows server remotely, Command Prompt commands for server admins.

Ucartz Windows VPS plans (VPS Pro and Elite) include the Windows Server licence, and our engineers can run these repairs for you by the hour.

Official documentation: Microsoft: Use the System File Checker tool, Repair a Windows image with DISM, sfc command reference.