You open Command Prompt, type sfc /scannow, and Windows answers with a dead end: “Windows Resource Protection could not perform the requested operation.” No scan runs and no repair happens.
This error usually has one of a handful of causes, and each has a clean fix. This guide walks through them in the order that saves the most time.
What This Error Actually Means
System File Checker (SFC) scans protected Windows files and replaces damaged ones with cached copies. This error means SFC couldn’t start or finish that scan. It’s a failure of the tool itself, and it tells you nothing yet about whether your files are damaged.
The usual triggers:
- Command Prompt wasn’t launched with administrator rights
- The Windows Modules Installer (TrustedInstaller) service is disabled or stuck
- The component store (WinSxS) is corrupted, so SFC has nothing reliable to copy from
- A pending update or reboot is holding files hostage (often a stale pending.xml)
- Disk errors block SFC from reading or writing system files
- You ran SFC from the Windows Recovery Environment without telling it where Windows lives
- Third-party security software interferes with the scan
Quick Diagnosis: Which Error Do You Have?
SFC throws several similar messages. Matching yours saves you from chasing the wrong fix.
| Error Message | Most Likely Cause | Start With |
| Could not perform the requested operation | Permissions, pending operations, or recovery-environment syntax | Fix 1, 2, or 7 |
| Could not start the repair service | TrustedInstaller service disabled | Fix 3 |
| Found corrupt files but unable to fix some | Damaged component store | Fix 5 |
| There is a system repair pending | Stale pending.xml or unfinished update | Fix 4 |
Fix 1: Run Command Prompt as Administrator
This is the cause more often than people admit. SFC needs elevated rights, and a standard window fails with this exact message.
- Click Start and type cmd.
- Right-click Command Prompt and choose Run as administrator.
- Confirm the title bar reads “Administrator: Command Prompt.”
- Run sfc /scannow again.
On Windows 11, Windows Terminal is the default, so right-click it and choose Run as administrator instead.
Fix 2: Restart, Finish Pending Updates, and Free Up Space
A half-installed update locks the files SFC needs. Restart the PC, then open Settings > Windows Update and let anything pending finish. Restart again if prompted.
Also check that your system drive has at least 10 GB free. SFC and DISM both need a working room, and a nearly full C: drive causes odd failures.
Fix 3: Start the Windows Modules Installer Service
SFC relies on TrustedInstaller to modify protected files. If that service is disabled, the scan can’t proceed.
Open an elevated Command Prompt and run these two commands:
sc config trustedinstaller start= demand
net start trustedinstaller
The space after start= is required. When the service reports it started successfully, run sfc /scannow again.
Fix 4: Clear a Stuck pending.xml File
If Windows began an update and never finished, a leftover pending.xml can block SFC. This is a common cause on machines that lost power mid-update.
- Boot into Safe Mode (Settings > System > Recovery > Advanced startup > Troubleshoot > Startup Settings > Restart > press 4).
- Open an elevated Command Prompt.
- Run:
ren C:\Windows\WinSxS\pending.xml pending.old
- Restart normally and try SFC again.
Renaming is safer than deleting. If something goes wrong, you can rename the file back.
Fix 5: Repair the Component Store with DISM
SFC pulls replacement files from the component store. If the store itself is damaged, SFC has nothing good to restore from. DISM repairs the store first.
Run these in order from an elevated Command Prompt:
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
RestoreHealth can sit at 20% or 62% for a long time. That’s normal, so give it 20 to 30 minutes before worrying. It downloads clean files from Windows Update, so you need a working internet connection.
When it finishes, restart and run sfc /scannow.
If DISM Fails Too
Mount a Windows ISO that matches your installed version and edition. Then point DISM at it. Replace E: with your mounted drive letter:
DISM /Online /Cleanup-Image /RestoreHealth /Source:WIM:E:\sources\install.wim:1 /LimitAccess
The index number (:1) must match your edition. Check with DISM /Get-WimInfo /WimFile:E:\sources\install.wim. Some ISOs ship install.esd instead of install.wim, so use ESD: and that filename in that case.
Fix 6: Check the Disk for Errors
Bad sectors and file system errors stop SFC from reading or writing files reliably. From an elevated prompt, run:
chkdsk C: /f /r
Windows will ask to schedule the check at the next restart. Type Y, reboot, and let it run. On a large drive this can take an hour or more, especially with /r.
If CHKDSK reports many bad sectors, back up your data now. A drive failing physically needs replacement, not just repair.
Fix 7: Use the Correct SFC Syntax in the Recovery Environment
If you booted from Windows installation media or the Recovery Environment, plain sfc /scannow fails. In that environment, the drive letters differ, and SFC doesn’t know which Windows installation to scan.
First find your Windows drive letter, which often isn’t C: in recovery:
diskpart
list volume
exit
Then run SFC with offline parameters (assuming Windows is on D:):
sfc /scannow /offbootdir=D: /offwindir=D:\Windows
This is the standard fix for PCs that can’t boot normally, and it resolves this error in recovery mode more often than any other step.
Fix 8: Temporarily Disable Third-Party Antivirus
Some security suites lock protected system files during a scan. Disable real-time protection briefly, run SFC, then turn protection back on immediately.
Windows Security (Defender) rarely causes this. Third-party products are the usual offenders, so uninstalling a stubborn one with the vendor’s removal tool is a legitimate step if it keeps interfering.
Fix 9: Repair Install or Reset as a Last Resort
If nothing above works, the system image is probably too damaged for command-line repair. You have two options:
| Option | What It Keeps | Pros | Cons |
| In-place upgrade repair (run Setup from a Windows ISO, choose “Keep personal files and apps”) | Files, apps, settings | Fixes system files without data loss; no reinstalling programs | Takes 30 to 90 minutes; needs an ISO matching your version |
| Reset this PC (Keep my files) | Personal files only | Fast, built into Windows | Removes installed apps and settings |
| Clean install | Nothing | Eliminates all corruption | Requires full backup and reinstall of everything |
The in-place upgrade is the best first choice. It replaces every system file while leaving your programs and documents alone.
How to Read the SFC Log After It Runs
Once SFC completes, it reports one of a few results. Here’s what each one means:
- “Did not find any integrity violations”: your system files are fine. Look elsewhere for your original problem.
- “Found corrupt files and successfully repaired them”: done. Restart.
- “Found corrupt files but was unable to fix some of them”: run DISM (Fix 5), then SFC again.
To see exactly which files were affected, extract the SFC entries from the CBS log:
findstr /c:”[SR]” %windir%\Logs\CBS\CBS.log > “%userprofile%\Desktop\sfclogs.txt”
Open sfclogs.txt on your desktop. Lines mentioning “cannot repair member file” name the damaged files. Searching those filenames often reveals whether a specific update or driver caused the damage.
Quick Troubleshooting Checklist
- [ ] Command Prompt opened as administrator
- [ ] PC restarted and Windows Update finished
- [ ] At least 10 GB free on the system drive
- [ ] TrustedInstaller service set to manual and started
- [ ] pending.xml renamed (if present)
- [ ] DISM RestoreHealth completed successfully
- [ ] CHKDSK run with no unresolved errors
- [ ] Offline SFC syntax used if running from recovery media
- [ ] Third-party antivirus disabled during the scan
Preventing This Error in the Future
Most recurrences trace back to interrupted updates and unhealthy drives. A few habits help:
- Don’t force a shutdown while Windows says “Working on updates.”
- Check drive health occasionally with a SMART tool such as CrystalDiskInfo.
- Keep your system drive from filling up.
- Create a restore point before installing major drivers or updates.
Frequently Asked Questions
Why does SFC say Windows Resource Protection could not perform the requested operation in Safe Mode?
Safe Mode loads a minimal set of services, and in some setups TrustedInstaller isn’t running. Start it manually with net start trustedinstaller. If the service refuses to start, run sfc /scannow in normal mode after fixing the component store with DISM.
Can I fix this error without losing my files?
Yes. Every fix from 1 through 8 leaves your files untouched. The in-place upgrade repair also keeps your files and apps. Only a clean install or a reset without the “keep files” option removes data.
Should I run DISM or SFC first?
Run DISM first if SFC is failing, because it repairs the source SFC copies from. After DISM finishes, run SFC to repair the individual system files.
Is this error a sign of malware or a failing hard drive?
Not by itself. It’s far more often a permissions issue or a stuck update. If CHKDSK finds bad sectors or the error returns repeatedly after a repair, run a full antivirus scan and check your drive’s SMART health.
