Menu Close

Parsing Log File Entries Generated by SFC.exe

The sfc /scannow command will most likely scan all protected system files and will repair corrupted files with a perfect cached copy located in the compressed folder %WinDir%\System32\dllcache.
The %WinDir% placeholder symbolizes the operating system directory. Example: C:\Windows.

Note. Probably don’t close this command prompt window until the detailed check is 100% complete. The last scan will appear after the article has been processed.

Swipe in from the right edge of the screen, then tap Search. Or, if you’re using a PC, hover your mouse over the bottom right corner of the screen and click Search. Type Command Prompt Command in the search box, right-click Command Prompt Command, and select Run as administrator. If public users are prompted to confirm security or administrator, enter a specific password or click Allow.

To do this, click “Start”, enter the code Command line or cmd in the search field, right-click on the prompt handle and select “Run as administrator”. If prompted for a manager password or confirmation, enter the password or click Allow.

Once you know which file has been corrupted and cannot be repaired using the special detailed information in the Sfcdetails.txt database, locate the corrupted file and then manually replace the dangerous file with a reliable copy file. For this skill, do the following:

Note. You can get a known good copy of a system file, including on another computer with the same version of Windows as your current computer. You can run a System File Checker process on this computer to make sure that the system archive you are trying to copy is indeed a good copy.


When a Windows installation fails, the result code and extension is typically logged as an informational event fired in the Application log by Windows Error Reporting as event 1001. The event name is WinSetupDiag02. You can use the Event Viewer to view this process event or rely on Windows PowerShell.

To use Windows PowerShell, type the following commands at an elevated Windows PowerShell prompt:


$events = Get-WinEvent -FilterHashtable @LogName="Application";ID="1001";Data="WinSetupDiag02"
$event is [xml]$events[0].ToXml()
    1. Open Event Viewer and navigate to Windows Logs\Applications.
    2. Click Search and search for winsetupdiag02 if needed.
  1. Double-click the selected event.
Settings P1: install script (1=media, 5=windows update, 7=media creation tool) P2: Configuration mode (x=default,1=low level,5=failuret) P3: Installing new OS architecture (x=standard,0=x86,9=amd64) p4: Result (x=Error,0=Success,1=Error,2=Cancel,3=Blocked) P5: Result error code (ex: 0xc1900101) P6: Expand error code (eg: 0x20017) P7: original OS version (example: 9600) P8: Source OS branch (probably not available) P9: New OS version (for example: 16299} P10: New OS branch (eg: rs3_release}


The event also contains links to log documents that you can use to get the job done and get detailed diagnostics of these errors. See an example of a successful update below.

Windows 10 FAQ for IT Pros
System requirements for Windows 10 Enterprise
Windows 10 specifications
Windows 10 IT forums
Fix Windows Update errors with DISM and the System Update Readiness Tool


The following source will only be available if you have completed theUpgrading to a newer version on a previous version of Windows 10. If you actually have the current version installed and not up to date, the source named WinSetupDiag02 will not be available.


Does SFC Scannow fix anything?

The sfc /scannow command diagnoses all protected system files and fills in corrupted files using the cached emulator located in the push folder at %WinDir%\System32\dllcache. This means that you do not have any missing or corrupted system files.


This article explains how to understand the log files generated by the Microsoft Windows Resource Checker (SFC.exe) program in Windows.


How do I fix a corrupt CBS log file?

Scan your current computer for malware.
Run the DISM command.
Reset this computer to factory settings.
Check for a persistent disk problem.


Applies to: Windows Vista and its versions
Later original KB number: 928228


You can use the SFC.exe tool to troubleshoot Windows User Mode crashes. This can lead to crashes related to missing or corrupted system files.


  • Check that the Windows plan’s immutable files have not been modified. In addition, it is checked whether these files match the definition of the respective operating system, which type of files should be downloaded to the computer.
  • It will restore non-custom Windows template files whenever possible.

Check Log File

SFC.exe generates detailed information about each operating configuration check and restore instructions to help you in the CBS.log file. Each SFC.exe device entry in this file has 1 [SR] tag. The CBS.log file is actually located in the %windir%\Logs\CBS folder.

You can search for [SR] tags to find entries for the SFC.exe program. To get good results from this type of search and redirect the results to a file to be overwritten, do the following:

  1. Click Start (this is the cmd type in the Start Search package), right-click cmd in the Programs shopping list, and select Run as administrator.
    If you are prompted for a manager password or confirmation, format the password or click Next.
  2. Type the following command and press ENTER:
    findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >sfcdetails.txt

Is SFC Scannow safe to run?

Running a Simple SFC Scan
The SFC command also works on Windows 10, as well as Windows 8.1, 8, and even 7. Windows Resource Protection may not have detected any integrity violations: there are no system-written, missing, or corrupted documents, and no further action is required. urgent need.


The Sfcdetails.txt file may also contain entries that are logged each time the SFC.exe program is run on the computer.

Interpreting Log Tracking Entries

SFC.exe scans files for groups of 100 files, so there are certainly many groups of SFC.exe school records. Kawaiting entry has the following format:

The following example snippet from the CBS.log file shows that SFC.exe found no problems with Windows system files:


The following example snippet from the CBS.log file shows that the SFC.exe tool identified problems with all Windows system files:


The following list describes other messages that may be logged in the SFC.exe program entries in the CBS.log directory after the scan is complete.


How do I fix Windows corruption error?

Use some of the SFC tools.
Use the DISM tool.
Run a trusted SFC scan in safe mode.
Run a good reliable SFC scan before starting Windows 10.
Replacing files manually.
Use System Restore.
Reset your current Windows 10.


  • Entry 1: Failed to restore member file information. For example:
    Could not restore member file Microsoft-Windows-IE-WinsockAutodialStub [l:147]"url.dll", Version=6.0.5752.0, pA equal to PROCESSOR_ARCHITECTURE_INTEL(0), culture-neutral, VersionScope equal to 1 nonSxS , PublicKeyToken = l:8 b:31bf3856ad364e35, type neutral, type N

    How do I fix a corrupt CBS log file?

    Scan your computer for a variety of malware.
    Run the DISM command.
    Reset your computer to factory settings.
    Check for hard drive problems.


    Does SFC Scannow fix anything?

    The sfc /scannow command requires scanning all protected files in the suite and replacing corrupted files if it is a cached copy found in a compressed folder directly under %WinDir%\System32\dllcache. This means that you do not have any missing or corrupted system files.