Proper way to setup for run sfc /scannow with XP / SP-3 ?

How should XPpro/SP-3 be setup to run sfc /scannow properly ?
Eg, what disk should it be asking for, and is there any special setup needed to get it to ask for the proper disk and at the same time have it working for all of XP,(files) including SP-3 ?
 

Question Info


Last updated October 23, 2018 Views 4,062 Applies to:
How should XPpro/SP-3 be setup to run sfc /scannow properly ?
Eg, what disk should it be asking for, and is there any special setup needed to get it to ask for the proper disk and at the same time have it working for all of XP,(files) including SP-3 ?

check this kb, it has much info regarding sfc
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/system_file_checker.mspx?mfr=true

http://support.microsoft.com/kb/929833

http://www.bleepingcomputer.com/forums/t/43051/how-to-use-sfcexe-to-repair-system-files/

H.A.V. Aravinda

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Xp looks for the xp installation cd (retail only)..

Also,when Sfc runs,it only looks at xp core files,SP 1,2 or 3

are not included,nor are the security updates and hotfixes..

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Xp looks for the xp installation cd (retail only)..

Also,when Sfc runs,it only looks at xp core files,SP 1,2 or 3

are not included,nor are the security updates and hotfixes..


Thank you for the info.
Thats the clarification needed, simple and clear, and it makes sense... but Ive seen so many takes in different forums.
Any idea if this is somewhere documented by Microsoft ?
Thanks again for your help.


And, thanks again for your help !

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Are you having some issues that you think SFC will correct or are you just practicing?

In order for SFC to run properly, you have to have a genuine bootable XP installation CD that is the same Service Pack as your installed SP or SFC is going to complain - a lot.

SFC needs a source of known "good" files to compare against what is on your system and if you are running SP3, that can only be a genuine bootable XP installation CD that already has SP3 on it.
You can also tell SFC to look someplace else for the known good files - I have mine looking in a folder on an external HDD where I have copied the entire XP SP3 installation CD.

Many people seem to have no genuine bootable XP installation either because their store bought system did not come with one, they lost it, the dog ate it, etc.  If you happen to have a genuine bootable XP installation CD that is either SP1 or SP2 and your system is running SP3, you can make a new installation CD with SP3 integrated into it through a process called 'slipstreaming'. 

Making a slipstreamed CD is a good idea and we can point you in the right direction to do that if you have an outdated genuine bootable XP installation CD.

Then you can run SFC /scannow to your hearts content, but it will probably not do what you think it is going to do or what people tell you it is going to do or people they think it is supposed to do.

It is a misconception that SFC will replace missing or damaged system files and I will include a test scenario to prove that for anyone to try that thinks that is the case.   I would encourage anyone that thinks SFC /scannow replaces missing or corrupt system files to run this test scenario.  Then you will learn what SFC /scannow does and what it doesn't do.

SFC /scannow is designed to run one time when XP is installed and it's job is to populate the dllcache folder with backup copies of critical system files.  If any one of those 3498 system files (yes there is a list on my SkyDrive) comes up missing on your system, Windows File Protection will attempt to quickly and silently replace the missing or corrupt file using the backup copy in the dllcache folder and put a message like this in the Event Viewer System log:

Event Type:    Information
Event Source:    Windows File Protection
Event Category:    None
Event ID:    64002
Description:
File replacement was attempted on the protected system file c:\windows\system32\taskmgr.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.

To see that example, just rename your c:\windows\system32\taskmgr.exe file to something you can remember like 'taskmgr.xxx' and when WFP sees the file missing, it will quickly and silently replace it.  That is WFP in action then look in the Event Viewer System log.

Note that if you run SFC and if it finds a file in the dllcache folder that needs to be replaced, you will not be able to tell what it did or if it did anything at all.  All you will see in the Event Viewer are messages that it started and stopped - there is no message or clue about what it did or didn't do which makes running it more of a waste of time.

For Windows XP (that would be this forum), when sfc /scannow starts and completes, there is no message displayed after the scan, but there are only events in the Event Log that look like this:

Event Type:    Information
Event Source:    Windows File Protection
Event Category:    None
Event ID:    64016
Description:
Windows File Protection file scan was started.

Event Type:    Information
Event Source:    Windows File Protection
Event Category:    None
Event ID:    64017
Description:
Windows File Protection file scan completed successfully.

Even if sfc /scannow finds a file to replace in the %Systemroot%\system32\dllcache folder and replaces a file there is  no message displayed or not event even logged in the Event Viewer so you will never know if it did anything or not.

So, what is the point of these suggestions we see almost every day to get folks to try to run sfc /scannow when they have system problems, or try to run it in Safe Mode (when sfc /scannow will not even run in Safe Mode) and most folks don't have a genuine bootable XP installation CD that is the same SP as their installed SP in the first place?

I do not understand it.

Microsoft engaged Support Engineer "experts" like to suggest SFC /scannow but to me, that is akin to saying "I have no idea what the problem is or how to fix it".   They also like to suggest running it in Safe Mode, but SFC will not run in Safe Mode (this means they don't try their own suggestions to see if they work).

If you would actually try running SFC /scannow in Safe Mode, you will get the following messages:

Windows File Protection could not initiate a scan of protected system files.
The specific error code is 0x000006ba [The RPC server is unavailable.].

You cannot start the RPC Server in Safe Mode either.

Here is a message I send to the Microsoft engaged Support Engineers when they suggest that people waste more time trying to run SFC /scannow.  If you follow this exercise, you will learn what SFC /scannow does and what it doesn't do.

Here is a popular error message that is easy to resolve, but these "experts" always suggest to run SFC /scannow (which will not help) and further reinforces the idea that the MS engaged "experts" do not know how XP work.  THe error is:

Control Panel
Windows cannot find 'C:\WINDOWS\system32\rundll32.exe'.  Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

Microsoft engaged Support Engineer "experts" and others always suggest sfc /scannow for that error but it will never solve the problem because that is not how sfc /scannow works, that is not what it does and that is not what it is for.  You can see for yourself if you keep reading and follow the exercise.

Now for the learning part:


Dear:  <Insert Microsoft engaged Support Engineer "expert" Name Here>:

Before you suggest running sfc /scannow, you need to first find out if the user has a genuine bootable XP installation CD that has the same Service Pack as their installed Service Pack (most people don't).  If they do not, sfc /scannow is going to complain - a lot, so why do you suggest it?  Why don't you just say "I have no idea what the problem is or how to fix it".

Running sfc /scannow will not replace the missing rundll32.exe file.

Why do you continuously  post "Methods" that do not work and will only waste time?

Have you ever even seen this problem before, tried to recreate it so you can actually see it, or have you ever actually fixed it?

That is not what sfc /scannow does, that is not how it works and that is not what it is for and here is a test so you can see for yourself how sfc /scannow does work.

Why don't you learn what sfc /scannow does and doesn't do?

Here is a simple test for you and all your Support Engineer colleagues:

I implore you to run this simple test and then you might actually learn how sfc /scannow works:

For this example, let's use the critical system file rundll32.exe.

Rename or delete your c:\windows\system32\rundll32.exe.exe file so the file is now "missing".

If Windows File Protection is running, the "missing" file will be quickly and silently replaced and you will see an event like this in the Event Viewer System log:

Event Type:    Information
Event Source:    Windows File Protection
Event Category:    None
Event ID:    64002
Description:
File replacement was attempted on the protected system file c:\windows\system32\rundll32.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.

That is Windows File Protection in action.

Now boot your system in Safe Mode or the Recovery Console so Windows File Protection is not running.

Rename or delete your c:\windows\system32\rundll32.exe.exe file so the file is now really "missing".  Since WFP does non run in Safe Mode or the Recovery Console, the file will not automatically be replaced like it was before.

That is a critical system file, right?  It is on the list of 3498 file that Windows File Protection and SFC knows about but now it is missing.

Now, with your rundll32.exe file missing, boot into Normal mode and try to use Control Panel to open the Internet Options or the Power Options and you will see the error that the file is missing (now you have reproduced the error):

Control Panel
Windows cannot find 'C:\WINDOWS\system32\rundll32.exe'.  Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.


Now follow you own advice and run sfc /scannow to completion.

The rundll32.exe is still missing, right?  Did running sfc /scannow replace the missing  critical system file?  No it did not.

How can that be if sfc /scannow is supposed to replace missing system files?  That is because that is not what sfc /scannow does.

Now you know what sfc /scannow does not do.  It did not replace your missing system file like you said it would do (be sure to put your rundll32.exe back so you will have one).

Now navigate to c:\windows\system32\dllcache and delete or rename the rundll32.exe file from there - and it will stay gone and not be automatically replaced since Windows File Protection does not look after that folder.

Run sfc /scannow to completion again.

The missing rundll32.exe file in the dllcache folder will be replaced, since that IS the folder that sfc /scannow looks after for missing files.

Now you know what sfc /scannow does do.

Do you need help in learning about corrupt system files too?

Since most people to not have a genuine bootable XP installation CD, they will not be able to expand a copy of the missing file from the installation CD they do not have.  Another bad suggestion.

Why don't you post some directions on how to replace the file when the user has no genuine bootable XP installation CD and that will be useful to everyone, or at least post some ideas that actually work (that means you have tried them yourself).

If you do not know how, say "I do not know how" and I will help you learn how.








Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Are you having some issues that you think SFC will correct or are you just practicing?
In order for SFC to run properly, you have to have a genuine bootable XP installation CD that is the same Service Pack as your installed SP or SFC is going to complain - a lot.

Thank you for the detailed info.
Although it sounds like, as noted in original post, we are getting differences of 'opinion', like at a lot of other forums re the subject ?...

Andrew E. replied to akmbd166 (previously)...

Xp looks for the xp installation cd (retail only)..

Also,when Sfc runs,it only looks at xp core files,SP 1,2 or 3

are not included,nor are the security updates and hotfixes..


Which sounds different from what you have noted.
Would really like to see (in order to then make a decision as to whether it is a good 'maintenance' tool, or not) an official Microsoft documentation of what SFC can fix, and the proper procedure to do so, ie per previous post...

akmbd166 replied to Andres E. (previously)...

Thank you for the info.

Thats the clarification needed, simple and clear, and it makes sense... but Ive seen so many takes in different forums.
Any idea if this is somewhere documented by Microsoft ?
Thanks again for your help.

Also, am still digesting the rest of your post, and find the 'slipstreaming' suggestion interesting.
Is there a place to see more info about that process ?

Thanks again for your reply.

And, thanks again for your help !

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Anybody that claims sfc /scannow 'replaces missing or corrupt system files' only needs to run my little test scenario to see that it does not replace missing or corrupt system files in the system32 folder.

It does replace missing or corrupt files system files in the dllcache folder - that is what it is supposed to do - and the dllcache folder does not come into play while XP is running.  You can totally empty it or rename the dllcache folder so it is completely 'missing' and XP will still work just fine.

Microsoft says:

If the %systemroot%\system32\dllcache folder becomes corrupt or unusable, use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents of the Dllcache directory.

Notice it does not say anything about the system32 folder.

If you empty the dllcache folder and have a genuine bootable XP installation CD that is the same SP as your installed SP and then run sfc /scannow, the dllcache folder will be repopulated.  That is what it is for.

What people need to say about sfc /scannow is that it 'replaces missing or corrupt system files in the dllcache folder'.  That part is always missing.

Try the test scenario I posted involving the rundll32.exe file.  You can't hurt anything, if something goes wrong, it is easy to fix and when you get done you will see for yourself what sfc /scannow doesn't do and what it does do. 

Folks that say sfc /scannow 'replaces missing or corrupt system files' are only parroting what other people say or what they have read and misinterpreted.  They have never actually tried to make a test case to understand what sfc /scannow really does, so I made the test scenario for them to help them understand so they can see it for themselves.  Seeing is believing (sometimes).

They need only to run that test scenario one time and they will change their tune.  It has converted many people so instead of going by what other people say, you have an opportunity now to find out for yourself how it works,

Suggesting is is also likely to be a waste of time unless you are sure that the person has a genuine bootable XP installation CD that is the same Service Pack as the installed SP.  Since most people don't (and the question is never asked before suggesting sfc /scannow) it is just a wasted message cycle.

Before I took the time to figure it out (years ago) I used to suggest it sometimes only because I saw what I though were other knowledgeable people suggesting it - but it never did any good or was impossible (especially after SP3 came out) since nobody had a SP3 installation CD.

Then I sat down and figured out what it really does and doesn't do and will never suggest it again.

I believe that it is a desperate suggestion that means 'I have no idea what the problem is or how to fix it'.



Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Anybody that claims sfc /scannow 'replaces missing or corrupt system files' only needs to run my little test scenario to see that it does not replace missing or corrupt system files in the system32 folder.

It does replace missing or corrupt files system files in the dllcache folder - that is what it is supposed to do - and the dllcache folder does not come into play while XP is running.  You can totally empty it or rename the dllcache folder so it is completely 'missing' and XP will still work just fine.

Microsoft says:

If the %systemroot%\system32\dllcache folder becomes corrupt or unusable, use sfc /scannow, sfc /scanonce, or sfc /scanboot to repair the contents of the Dllcache directory.

Notice it does not say anything about the system32 directory/folder or any other directory/folder.

If you empty the dllcache folder and have a genuine bootable XP installation CD that is the same SP as your installed SP and then run sfc /scannow, the dllcache folder will be repopulated.  That is what it is for.

What people need to say about sfc /scannow is that it 'replaces missing or corrupt system files in the dllcache folder'.  That part is always missing.

Try the test scenario I posted involving the rundll32.exe file.  You can't hurt anything, if something goes wrong, it is easy to fix and when you get done you will see for yourself what sfc /scannow doesn't do and what it does do. 

Folks that say sfc /scannow 'replaces missing or corrupt system files' are only parroting what other people say or what they have read and misinterpreted.  They have never actually tried to make a test case to understand what sfc /scannow really does, so I made the test scenario for them to help them understand so they can see it for themselves.  Seeing is believing (sometimes).

They need only to run that test scenario one time and they will change their tune.  It has converted many people so instead of going by what other people say, you have an opportunity now to find out for yourself how it works,

Suggesting is is also likely to be a waste of time unless you are sure that the person has a genuine bootable XP installation CD that is the same Service Pack as the installed SP.  Since most people don't (and the question is never asked before suggesting sfc /scannow) it is just a wasted message cycle.

Before I took the time to figure it out (years ago) I used to suggest it sometimes only because I saw what I though were other knowledgeable people suggesting it - but it never did any good or was impossible (especially after SP3 came out) since nobody had a SP3 installation CD.

Then I sat down and figured out what it really does and doesn't do and will never suggest it again.

I believe that it is a desperate suggestion that means 'I have no idea what the problem is or how to fix it'.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Excellent dissection of a poor utility .. Thank You
Crescent City Ca Vacation Homes

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

It is a good utility that does exactly what it is designed to do!

The problem is that most people have the wrong impression of what it is supposed to do (including Microsoft engaged Support Engineer "experts").

All anybody has to do is run the test scenario posted 08/14 and learn how it really works. 

I can only think of one person that has actually taken the time to do that - but it was worth it to him.

I did not make all that stuff up on 08/14 either.  I have already figured this out a long time ago and wrote it down.  Long ago, I used to think incorrectly about it too - then I sat down, did some reading and research and figured it out.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.