Windows Resource Protection Found Corrupt Files – What It Means and How to Read the SFC Log

When you run the System File Checker command sfc /scannow on Windows 11 or 10, you might see this message at the end of the scan: Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. That message may be confusing if you’re not sure what Windows Resource Protection is or how to check the CBS.log file.

This article explains:

• What Windows Resource Protection and SFC actually do
• What does it mean when they “find corrupt files”
• How to view and understand the SFC log (CBS.log)
• What repair options do you have next

What Is Windows Resource Protection (WRP)?

Windows Resource Protection (WRP) is a core Windows feature that helps protect critical system files, folders, and registry keys from unauthorized modification.

It ensures that key system components:

• Cannot be easily overwritten by third‑party programs or malware
• Are monitored for corruption or unauthorized changes
• Can be restored from a trusted source if they become damaged

The System File Checker (SFC) tool is one of the main ways Windows Resource Protection checks and repairs protected files.

When you run sfc /scannow, the Windows Resource Protection:

• Scans all protected system files on your system
• Compares them to known good copies in the Windows component store (WinSxS)
• Replaces corrupted or modified files with clean copies when possible

What Does “Windows Resource Protection Found Corrupt Files” Actually Mean?

When SFC finishes, you might see one of several messages. The one we’re focusing on here is:

“Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log…”

This means:

• SFC did find corrupted or modified system files.
• It was able to repair some or none of them.
• At least one protected file could not be fixed using the usual method (replacing from the component store).

Common reasons why SFC cannot fix some files:

• The component store (Windows image) that SFC uses as a source is itself corrupted.
• Some files are in use or locked and cannot be replaced while Windows is running.
• There are file system errors or bad sectors on the disk.
• Security or third‑party software is blocking changes.

To understand exactly which files are affected and what SFC tried to do, you need to look at the log file referenced in the message.

How to View SFC Details in CBS.log (sfclogs.txt)

The SFC scan details are stored in a log file called CBS.log.

• Default path:

  C:\Windows\Logs\CBS\CBS.log

This file contains a lot of information, not just SFC entries, so the easiest way is to extract only the lines related to SFC.

How to Save SFC details to a readable log

• Open Command Prompt as administrator:

  • Press Windows + S, type cmd.
  • Right‑click Command Prompt and choose Run as administrator.

• In the elevated command prompt, run this command:

  findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log > "%userprofile%\Desktop\sfclogs.txt"
  

• Press Enter.

• On your Desktop, you should now see a file named sfclogs.txt.

• Double‑click sfclogs.txt to open it in Notepad.

This file contains only the lines from CBS.log that relate to System File Checker (they are tagged with [SR]).

How to Read the SFC Log (sfclogs.txt)

When you open sfclogs.txt, you’ll see many lines. Each line describes an operation SFC performed or tried to perform.

Look for entries that mention cannot repair or similar phrases. For example (this is just an example, not an exact log line):

Cannot repair member file [l:24{12}]"somefile.dll" of somecomponent, Version = ..., Hash mismatch

Key things to note:

• The file name being referenced (for example, somefile.dll).
• Whether SFC says it repaired the file or could not repair it.
• Whether multiple attempts were made.

In many cases, these log lines are mainly useful for advanced users and admins who want to know exactly what’s wrong. For typical home users, the logs confirm that there is real corruption and that SFC alone can’t handle it.

You can:

• Use the file names to search for more information online.
• Compare with files on another healthy system (advanced).
• Decide whether to move on to DISM or other repair methods.

If you just want to fix the problem without digging too deep into the log, skip ahead to the “What You Should Do Next” section below.

What You Should Do After Seeing This Error

Once you know SFC has found corrupted files that it cannot repair, you have a few main options.

In summary:

1. Run SFC again in Safe Mode
2. Use DISM /RestoreHealth to repair the Windows image
3. Check the disk with CHKDSK if you suspect disk errors
4. Use Startup Repair, System Restore or Reset this PC as last resorts

Below is a brief overview of each. For full step‑by‑step instructions, follow the link to our dedicated fix guide.

 

Run SFC again in Safe Mode

Sometimes third‑party drivers, services or antivirus programs interfere with SFC. Running SFC in Safe Mode reduces that risk.

Basic idea:

• Boot Windows 10/11 into Safe Mode (via Advanced Startup → Startup Settings).

• Open Command Prompt (Admin).
• Run sfc /scannow again.
• Check if it now says the files were successfully repaired.

2. Use DISM /RestoreHealth

If the Windows image (component store) is corrupt, SFC cannot get clean replacement files. That’s what DISM is for.

Short version:

• Open Command Prompt as admin.
• Run: DISM /Online /Cleanup-Image /RestoreHealth
• Wait for the process to complete (this can take a while).
• Then run sfc /scannow again.

If DISM reports errors or cannot find source files, you may need to use a Windows ISO as a source. We cover that in detail in our what is DISM guide.

3. Check the disk with CHKDSK

If your disk or file system has errors, system files may keep getting corrupted.

Basic steps:

• Open Command Prompt as administrator.
• Run: chkdsk C: /f /r
• Type Y when asked to schedule at next restart.
• Restart and let CHKDSK scan and repair the disk.

After CHKDSK, run DISM and then SFC again.

Use Startup Repair, System Restore or Reset this PC

If nothing else works and Windows is still unstable, you may need to:

• Run Startup Repair from Advanced Startup.
• Use System Restore to roll back to a working restore point.
• Use Reset this PC (with “Keep my files” or “Remove everything”) as a last resort.

Frequently Asked Questions

Is it dangerous if Windows Resource Protection found corrupt files?

It depends:

• If SFC says it found and successfully repaired the files, that’s usually fine.
• If it says it found corrupt files but was unable to fix some of them, and you’re also seeing crashes, BSODs or update failures, you should treat it seriously and follow the repair steps.

Ignoring repeated, unrepaired corruption can lead to more serious system problems over time.

Do I need to read the CBS.log file as a normal user?

Not necessarily. The CBS.log and sfclogs.txt are most useful for:

• Advanced users
• IT support technicians
• People trying to diagnose exactly which files are corrupted

If you just want to fix your system, you can mainly:

• Run SFC in Safe Mode
• Use DISM /RestoreHealth
• Run CHKDSK if needed
• Use System Restore or Reset this PC if nothing else works

Does this error mean I have a virus?

Not always. Malware can corrupt system files, but other common causes include:

• Power outages or forced shutdowns
• Disk errors or bad sectors
• Failed Windows Updates or driver installations
• Hardware problems (failing RAM or storage)

You should run a full antivirus scan to be safe, but don’t assume this error always means malware.

Will I lose my personal files if I fix this error?

Tools like SFC, DISM and CHKDSK do not delete your personal files. They repair system files, the Windows image and the file system structure.

You only risk losing personal files if you choose options like Reset this PC (Remove everything) or perform a clean install without backing up. It’s always wise to back up important files before major repairs.