SFC (used to be “System File Checker” but is now called Windows Resource Checker) is an in-built tool for verifying the integrity of all Windows systems files and also replacing them with good versions in case of any corruptions. It has been around for a while – I first used it on Windows 2000 I think – though am sure there’s many differences from that version and the latest ones. For instance, XP and prior used to store a copy of the system protected files in a folder called Here<\/a> is a good article on the WinSxS folder. I recommend everyone read it.<\/p>\n Basically, the WinSxS folder contains all the protected files (under a “WinSxS\\Backup” folder) as well as multiple version of DLLs and library components needed by various applications. In a way this folder is where all the DLLs of the system are actually<\/em> present. The DLLs that you see at other locations are actually NTFS hard links<\/em> to the ones in this location. So even though the folder might appear HUGE when viewed through File Explorer, don’t be too alarmed as many files that you think might be taking up space elsewhere are not actually taking up space<\/a> because they are hard links<\/a> to the files here. But yes, the WinSxS is huge also because it has all those old DLLs and components, and you cannot delete the files in here because you never know what application depends on it. Moreover, you can’t even move the folder to a different location as it has to be in this known location for the hard links to work.<\/p>\n In contrast to the WinSxS folder, the DLLcache folder can be moved anywhere via a registry hack<\/a>. Also, the DLLcache folder doesn’t keep all the older libraries and such.<\/p>\n<\/div>\n The latest versions of SFC can also work against an offline install of Windows.<\/p>\n Here’s SFC on my computer complaining that it was unable to fix some errors:<\/p>\n It is best to view the log file using a tool like Rather than open the CBS.log in Open this file (saved on your Desktop) in Servicing is the act of enabling\/ disable a role\/ feature in Windows, installing\/ uninstalling updates and service packs. You can service both currently running and offline installations of Windows (yes, that means you can have an offline copy of Windows on a hard disk or a VHD file and you can enable\/ disable features and roles on it as well as install hot fixes and updates (but not service packs) – cool huh!). If you have used DISM<\/a> (Deployment Image Servicing and Management) in Windows 7 and upwards (or Windows XP and before used to have File Based Servicing. The update or hotfix package usually had an installer ( Windows Vista introduced Component Based Servicing (CBS). Whereas with File Based Servicing everything was mashed together, now there’s a notion of things being in “components”. So you could have various features of the OS be turned off or on as required (i.e. features and roles). The component itself could be installed to the OS but not active (for example: the files for a DNS server are already installed in a Server install but not activated; when you enable that role, Windows does stuff behind the scenes to activate it). This extends to updates and hotfixes too. For instance, when you install the Remote Server Admin Tools (RSAT) on Windows 7, it installs all the admin tool components but none of these are active by default. All the installer does is just add these components to your system. Later, you go to “Programs and Features” (or use DISM) to enable the components you want. CBS is the future, so that’s what I’ll be focussing on here.<\/p>\n From this blog post<\/a>:<\/p>\n A component in Windows is one or more binaries, a catalog file, and an XML file that describes everything about how the files should be installed. From associated registry keys and services to what kind security permissions the files should have. Components are grouped into logical units, and these units are used to build the different Windows editions. Each component has a unique name that includes the version, language, and processor architecture that it was built for.<\/p>\n<\/blockquote>\n Remember the Microsoft refers to the files (binaries such as libraries etc) in the WinSxS folder as payloads. So components consist of payloads that are stored in the Here’s a post from the Microsoft Servicing Guy on CBS<\/a>. Like we had It is worth pointing out that dependency resolution (i.e. feature Microsoft-Hyper-V-Management-PowerShell requires feature Microsoft-Hyper-V-Management-Clients for instance) is done by the CBS stack. Similarly, the CBS stack is what identifies whether any files required for a feature\/ role are already present on the system or need to be downloaded. All this info is passed on to the user-facing programs that interact with the user for further action.<\/p>\n Apart from the Component Store here are some other folders and files used by the CBS:<\/p>\n A component might contain many packages. For instance, the An update that you install – say KBxxxxxxxx – might have multiple packages with each of these packages targeting different components of the system. The payload in a package is copied to the Component Store; only the You can get a list of packages installed on your system using the To get the same info as a table rather than list (the default):<\/p>\n For instance, Note that the above component name doesn’t have a language. It is common to all languages. There are separate keys – such as Here’s a blog post from The Servicing Guy<\/a> talking about the above locations. Unfortunately, it’s only part 1 as he didn’t get around to writing the follow-ups.<\/p>\n Here’s a high-level summary of many of the points I touched upon above:<\/p>\n I haven’t worked much with CBS except troubleshooted when I have had problems or added\/ removed packages and such when I am doing some basic servicing tasks on my machine\/ virtual labs. Most of what I explain above is my understanding<\/em> of things from the registry key and the folders supplemented with information I found in blog posts and articles. Take what you read here with a pinch of salt.<\/p>\n<\/div>\n The Component Store can get corrupted, resulting in errors when installing updates and\/ or enabling features. Note: this is not corruption with the system<\/strong> – which can be fixed via tools such as Windows 8 and upwards can detect and fix such corruptions using If PowerShell is your weapon of choice (yaay to you!), you can use If corruptions are determined and you have asked for a repair then Windows Update\/ WSUS are contacted for good versions of the components. The Example:<\/p>\n Windows 7 and below use a Microsoft tool called CheckSUR<\/a> (Check System Update Readiness).<\/p>\n Here’s a blog post on using CheckSUR<\/a> to repair corruption. Note that CheckSUR can only repair manifests while The Component Store will keep growing as more updates are installed to a system. One way to reduce the size is to tell Windows to remove all payloads from older Service Packs. For instance, say the machine began life as Windows 7, then had updates applied to it, then a Service Pack. You know you will never uninstall this Service Pack so you are happy with removing all the older payloads from WinSxS and essentially tell the OS that from now on it must consider itself as Windows 7 Service Pack 1 for good – there’s no going back.<\/p>\n Here’s how<\/a> you can do that for the various versions of Windows:<\/p>\n Windows 7 and above also automatically do scavenging to remove unused components from the Component Store. Windows Vista and prior do scavenging on a removal event, so you can add and remove a feature to force a scavenging.<\/p>\n Windows 8 has a scheduled task<\/a> Check this blog post<\/a> for some screenshots.<\/p>\n Windows 8.1<\/strong> and Windows Server 2012 R2<\/strong> include a new DISM switch<\/a> to analyze the Component Store and output whether a clean up can be made.<\/p>\n The clean up can be done automatically or manually run via the task scheduler entry as previously mentioned. DISM too has a new switch<\/a> which does the same (but doesn’t follow the 30 days rule like the schedule task so it is more aggressive).<\/p>\n The above switch is available in Windows 8 and Windows Server 2012 too.<\/p>\n Note that the scavenging options above (Windows 7 and up) only remove previous versions<\/strong> of the components. They are not as aggressive as the options to re-base the OS to a particular service pack. Once the previous versions of the components are removed you cannot rollback to those older versions but you can still uninstall the update<\/strong> you are on.<\/p>\n Windows 8.1 and Server 2012 R2 introduce a new switch that lets you re-base<\/a> to whatever state you are in now. This is the most aggressive option of all as it makes the state of the system permanent. You cannot uninstall any of the existing updates after you rebase<\/strong> (any newer updates made hence can be uninstalled) – the state your system is in now will be frozen and become its new state. This new switch is called Windows Server 2012 introduces the concept of “features on demand”.<\/p>\n Remember I had said by default all the payloads for all the features in Windows are present in the WinSxS folder. When you enable\/ disable features you are merely creating hard-links for the files in WinSxS. What this means is that even though your Server 2012 install may not use a feature its files are still present and taking up space in the WinSxS folder. Starting with Server 2012 you can now uninstall<\/strong> (rather than remove) a feature so its files from the WinSxS folder are deleted.<\/p>\n Of course once you remove the files this if you want to enable the feature later you must also specify a source from where they can be downloaded. Check this blog post<\/a> for more info.<\/p>\n Update<\/strong>: A Feb 2015 post from the PFE team that goes into pretty much the same stuff I mention above in terms of reducing the WinSxS folder size.<\/p>\n","protected":false},"excerpt":{"rendered":" SFC SFC (used to be “System File Checker” but is now called Windows Resource Checker) is an in-built tool for verifying the integrity of all Windows systems files and also replacing them with good versions in case of any corruptions. It has been around for a while – I first used it on Windows 2000 … Continue reading Notes of SFC and Windows Servicing (Component Based Servicing)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[328,53,330,329,331],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1743"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=1743"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1743\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=1743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=1743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=1743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}%WINDIR%\\System32\\DLLCache<\/code><\/a> (but it would remove some of the protected files as disk space became scarce resulting in SFC prompting for the install media when repairing) while Vista and upwards use the %WINDIR%\\System32\\WinSxS<\/code> folder<\/a> (and its sub-folder %WINDIR%\\System32\\WinSxS\\Backup<\/code>).<\/p>\nThe WinSxS folder<\/h2>\n
C:\\> sfc \/scannow\r\n\r\nBeginning system scan. This process will take some time.\r\n\r\nBeginning verification phase of system scan.\r\nVerification 100% complete.\r\n\r\nWindows Resource Protection found corrupt files but was unable to fix some\r\nof them. Details are included in the CBS.Log windir\\Logs\\CBS\\CBS.log. For\r\nexample C:\\Windows\\Logs\\CBS\\CBS.log. Note that logging is currently not\r\nsupported in offline servicing scenarios.<\/pre>\n
trace32<\/code> or cmtrace<\/code><\/a>. Here’s a Microsoft KB article<\/a> on how to use the log file. And here’s a KB article that explains how to manually repair broken files<\/a>.<\/p>\nTip<\/h2>\n
trace32<\/code> it is better to filter the SFC bits first as suggested in the above KB articles. Open an elevated command prompt and type this:<\/p>\nfindstr \/c:\"[SR]\" %windir%\\Logs\\CBS\\CBS.log >\"%userprofile%\\Desktop\\sfcdetails.txt\"<\/pre>\n
trace32<\/code> and look for errors.<\/p>\n<\/div>\nServicing<\/h2>\n
pkgmgr.exe<\/code> & Co. in Vista) then you have dealt with servicing.<\/p>\nFile Based Servicing<\/h3>\n
update.exe<\/code> or hotfix.exe<\/code>) that updated the files and libraries on the system. If these were system files they were installed\/ updated at WINDIR%\\System32<\/code> and a copy kept at the file protection cache %WINDIR\\System32\\DLLcache<\/code> (remember from above?). If the system files were in use, a restart would copy the files from %WINDIR\\System32\\DLLcache<\/code> to WINDIR%\\System32<\/code>. Just in case you needed to rollback an update, a backup of the files that were changed was kept at C:\\Windows\\$Uninstall$KBnnnnnn<\/code> (replace “nnnnnn” with the KB number). Life was simple!<\/p>\nComponent Based Servicing<\/h3>\n
Components<\/h4>\n
\n
Component Store<\/h4>\n
%WINDIR%\\System32\\WinSxS<\/code> folder above? That’s where all these components are stored. That folder is the Component Store<\/span>. (As an aside: “SxS” stands for “Side by Side”. It is a complete (actually, more than complete) install of Windows that lives side by side to the running installation of Windows). When you install a component in Windows Vista and above, the files are actually stored in this component folder. Then, if the component feature\/ role\/ update is activated, hardlinks are created from locations in the file system to the files here. So, for instance, when you install a Server its component folder will already contains the files for the DNS role; later, when you enable the role hard links are created from WINDIR%\\System32<\/code> and elsewhere to the files in %WINDIR%\\System32\\WinSxS<\/code><\/a>.<\/p>\nPayloads<\/h2>\n
WinSxS<\/code> folder and manifests (not sure what they are) that are stored in the WinSxS\\manifests<\/code> folder.<\/p>\n<\/div>\nComponent Stack<\/h4>\n
update.exe<\/code> on XP and before, now we have trustedinstaller.exe<\/code> which is the interface between the servicing stack and user-facing programs such as “Programs and Features”, DISM, MSI, and Windows Update. The latter pass on packages (and downloads them if necessary) to trustedinstaller.exe<\/code> who invokes other components of the CBS stack to do the actual work (components such as CSI (Component Servicing Infrastructure), which you can read about in that link).<\/p>\nRelated folders and locations<\/h4>\n
\n
%windir%\\WinSXS\\Manifests<\/code> – Sub-folder of the Component Store, contains manifests<\/li>\n%windir%\\Servicing\\Packages<\/code> – A folder that contains the packages of a component. Packages are like components, they contain binaries (the payloads) and manifests (an XML file with the extension .MUM<\/code> defining the payload as well as the state of the package (installed and enabled, only installed, not installed)). When you run Windows Update, for instance, you download packages that in turn update the components.\nTelnet-Client<\/code> feature has just one package Microsoft-Windows-Telnet-Server-Package~31bf3856ad364e35~amd64~en-US~6.3.9600.16384.mum<\/code> on my machine, but the HyperV-Client<\/code> role has more than a dozen packages – Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~6.3.9600.16384.mum<\/code> being the package when the OS was installed, followed by packages such as Package_1033_for_KB2919355~31bf3856ad364e35~amd64~~6.3.1.14.mum<\/code> and Package_13_for_KB2903939~31bf3856ad364e35~amd64~~6.3.1.2.mum<\/code>, etc for various updates that were applied to it. (Remember<\/strong>: In XP and before updates targeted files. Now updates target components. So updates apply to components).<\/p>\n.MUM<\/code> defining the package is left in the %windir%\\Servicing\\Packages<\/code> folder. Moreover, each component is updated with details of the package which affects it – this is what we see happening when an update is applied to the OS and Windows takes a long time configuring things. (Remember components are self-sufficient. So it also knows of the updates to it).<\/p>\n\/Get-Packages<\/code> switch to DISM:<\/p>\ndism \/online \/Get-Packages<\/pre>\n
dism \/online \/Get-Packages \/Format:Table<\/pre>\n<\/li>\n
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing<\/code> – A registry key tree holding a lot of the servicing information.\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\PackageDetect\\Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~0.0.0.0<\/code> on my machine tells me which packages are a part of that component.<\/p>\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\PackageDetect\\Microsoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~0.0.0.0<\/code> – which contain packages for that specific language variant of the component.<\/p>\n<\/li>\n%windir%\\WinSXS\\Pending.xml<\/code> – An XML file containing a list of commands and actions to be performed after a reboot for pending updates (i.e. files that couldn’t be modified as they are in use)<\/li>\n%windir%\\Logs\\CBS\\CBS.log<\/code> – The CBS log file.<\/li>\n<\/ul>\nSummary<\/h4>\n
\n
Just so you know …<\/h2>\n
Service store corruptions<\/h3>\n
SFC<\/code> – but corruptions to the Component Store itself.<\/p>\nWindows 8 and later<\/h4>\n
DISM \/Cleanup-Image<\/code><\/a> (don’t forget to specify \/Online<\/code> for online servicing or \/Image:\\path\\to\\install<\/code> for offline servicing):<\/p>\n\n
DISM \/Cleanup-Image \/ScanHealth<\/code> will scan the Component Store for errors. It does not fix the error, only scans and updates a marker indicating the Store has errors. Any errors are also logged to the CBS.Log<\/code> file.<\/li>\nDISM \/Cleanup-Image \/RestoreHealth<\/code> will scan as above and also fix the error (so it’s better to run this than scan first and then scan & repair).<\/li>\nDISM \/Cleanup-Image \/CheckHealth<\/code> will check whether there’s any marker indicating the system has errors. It does not do a scan by itself (so there’s no real point to running this, except to quickly check whether any tool has previously set the marker).<\/li>\n<\/ul>\nRepair-WindowsImage -ScanHealth | -RestoreHealth | -CheckHealth<\/code> instead.<\/p>\n\/LimitAccess<\/code> switch can be used to disable this; the \/Source<\/code> switch can be used to specify a source of your own<\/a> (you must point to the WinSxS folder of a different Windows installation; see this TechNet article<\/a> for some examples). (Update<\/strong>: WSUS is not a good source so it’s better to use gpedit.msc<\/code> or GPOs to temporarily specify a Windows Update server<\/a>, or use the \/LimitAccess<\/code> switch to not contact WU\/ WSUS at all and specify a WinSxS folder to use).<\/p>\nDISM \/Online \/Cleanup-Image \/RestoreHealth \/Source:G:\\Sources\\SxS \/LimitAccess<\/pre>\n
Windows 7 and prior<\/h4>\n
DISM \/Cleanup-Image<\/code> can do both manifests and payloads<\/a>.<\/p>\nManaging the component store size<\/h3>\n
\n
VSP1CLN.EXE<\/code> to do this.<\/li>\nCompcln.exe<\/code><\/li>\nDISM \/online \/Cleanup-Image \/SpSuperseded<\/code> (for Windows 7 Service Pack 1 with update KB2852386<\/a> you can also use the Disk Cleanup Wizard<\/a> (cleanmgr.exe<\/code>)).\n\n
Automatic scavenging<\/h4>\n
StartComponentCleanup<\/code> that automatically cleans up unused components. It waits 30 days after a component has been updated before removing previous versions (so you have 30 days to rollback to a previous version of the update). You can run this task manually too:<\/p>\nschtasks.exe \/Run \/TN \"\\Microsoft\\Windows\\Servicing\\StartComponentCleanup\"<\/pre>\n
Windows 8.1 and Server 2012 R2 extras<\/h4>\n
Dism \/Online \/Cleanup-Image \/AnalyzeComponentStore<\/pre>\n
Dism \/online \/Cleanup-Image \/StartComponentCleanup<\/pre>\n
\/ResetBase<\/code>:<\/p>\nDism \/online \/Cleanup-Image \/StartComponentCleanup \/ResetBase<\/pre>\n
Windows Server 2012 and Server 2012 R2 extras<\/h4>\n